feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/ai-contract.md

@@ -11,8 +11,9 @@ MUST read:
 3. `.ai/domain.md` (+ `domain/domain-map.md` when touching models/API)
 4. `.ai/coding.md`
 5. Task-relevant: `api.md` / `database.md` / `ui.md` / `security.md` / `product/lexicon.md` + `product/feature-map.md`
-6. UI tasks: `design/design-system.md` + `design/component-catalog.md` + `design/platform/*`
-7. Relevant ADR under `.ai/adr/` if changing stack or style
+6. Run/dev tasks: `environment.md` + `development.md`（部署/镜像任务才读 `deployment.md` / `docker.md`）
+7. UI tasks: `design/design-system.md` + `design/component-catalog.md` + `design/platform/*`
+8. Relevant ADR under `.ai/adr/` if changing stack or style
 
 ## After coding
 
@@ -30,6 +31,7 @@ MUST:
 - Guess product requirement
 - Invent endpoints, tables, or domain words not in `.ai/domain.md` / OpenAPI / task
 - Silently reverse an Accepted ADR
+- Default local workflow to full-stack Docker / rebuild app images on every code change
 
 ## If unclear