feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/forbidden.md

@@ -19,14 +19,21 @@ AI obeys NEVER rules strictly.
 - Never invent response shapes other than `{code,message,data}`.
 - Never use POST for pure read/query.
 - Never skip migration when schema changes.
+- Never hand-apply schema changes on shared/prod DB instead of migrations.
+- Never edit already-merged migration files on `main` (fix forward).
 - Never hard-delete user PII without explicit task (use soft delete).
 
-## Security / deploy
+## Security / deploy / environment
 
 - Never hardcode passwords, tokens, or secrets.
 - Never commit `.env` or private keys.
 - Never use Docker image tag `latest` in production.
 - Never log full birthday + answers payloads casually.
+- Never introduce a **Docker-only** local coding workflow for Go/Vue.
+- Never require application **image rebuild** after every local code change.
+- Never put local secrets into Docker images.
+- Never mix local/dev config with production config or prod compose as daily default.
+- Never assume `docker compose up` must start api + web for development.
 
 ## Product / process