Can I vibecode ShowTrust?

Build me a testimonial collection and display tool. Requirements:

- Stack: one Node + TypeScript service (Fastify) with SQLite via better-sqlite3 and local disk
  for uploads. No Docker, no separate frontend build, no customer accounts.
- A public collection page at /c/:slug · name, role, company, avatar upload, 1-5 star rating,
  and the quote. Each field individually toggleable per project from a config row. Submissions
  land as pending. Show a thank-you state after submit.
- An /admin page behind basic auth from .env: pending queue with approve/reject, plus pin and
  delete on approved ones. Nothing is public until approved.
- An embeddable wall: GET /widget.js injects the approved testimonials into any page via one
  script tag plus a div, rendered into a shadow DOM so the host page's CSS can't leak in.
  No iframe.
- Offer three layouts (masonry, single-column list, horizontal carousel) and read layout,
  accent colour, light/dark theme and card corner radius from data- attributes on the tag.
- Server-render the widget HTML and have the script fetch it, so the testimonials are in the
  response rather than assembled client-side. Cache it with a short max-age plus
  stale-while-revalidate.
- Render every approved card in that response and hide the ones past a configurable initial
  count, then have Load More just unhide them · no second request, one paint, and the full set
  is in the HTML for crawlers.
- Drive all sizing from CSS custom properties on the container rather than per-element inline
  styles, so one stylesheet covers every layout and card style.
- Avatars resized server-side to 128px squares on upload with sharp; reject files over 5MB.
- Count impressions and click-throughs in SQLite · fire an impression only after the wall has
  been intersecting for one second, latch it so it can't fire twice per page load, and filter
  obvious bot user agents server-side.
- Rate-limit submissions per IP and add a honeypot field, because a public form will get spam.
- Ship a README with the paste-in snippet and VPS deploy steps behind TLS.
- Deliberately out of scope: video testimonials, importing from other platforms, team seats,
  and email notifications.