feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/file-map.md

@@ -54,6 +54,18 @@ No raw `fetch` in `pages/`.
 
 Rules, ADR, patterns, examples, playbooks, checklists. Not runtime code.
 
+### Environment docs
+
+| Path | Owns |
+|---|---|
+| `environment.md` | Local vs CI vs Prod policy |
+| `development.md` | Host Go / Vite local rules |
+| `docker.md` | When Docker is / is not used |
+| `deployment.md` | Prod immutable images / CI |
+| `commands.md` | Copy-paste commands |
+
+Runtime compose for **deps only**: repo-root `docker-compose.dev.yml`.
+
 ### .ai/product/ & .ai/domain/
 
 | Path | Owns |