feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/workflow.md

@@ -1,33 +1,48 @@
-# Workflow — Default Development Loop
+# Workflow — Feature Development Flow
+
+默认循环。环境：本机 Go/Vite + deps-only Docker（见 [development.md](development.md)）。
 
 ```
 Receive task
     ↓
-Read AI Contract + constitution + architecture + domain
+1. Understand
+   - feature-map / user-journey / lexicon（产品）
+   - domain-map / erd / OpenAPI（数据与契约）
+   - page-tree（路由）
     ↓
-Architecture Check (ADR + file-map + layers)
+2. Design（若有缺口）
+   - Update OpenAPI / erd / migration 草案
+   - ADR if stack/API style changes
     ↓
-Choose playbook (add-api / new-page / new-table / …)
+3. Implement
+   - Backend（service 竖切）→ Frontend
+   - Follow patterns + playbooks
     ↓
-Coding (follow patterns + examples)
+4. Verify
+   - commands（test / health / build:h5）
+   - review.md
+   - DoD + checklist
     ↓
-Commands (build / test / health)
+5. Document
+   - OpenAPI / erd / feature 标记若行为变化
     ↓
-Review (.ai/review.md)
-    ↓
-DoD + checklist
-    ↓
-Commit (Conventional Commits, one concern)
+Commit（Conventional Commits，one concern）
 ```
 
-## Architecture Check questions
+## Architecture Check
 
-1. Does this change reverse an Accepted ADR? If yes → ASK / new ADR.
-2. Correct layer? Handler / Service / Repository?
-3. Domain words match `.ai/domain.md`?
-4. API envelope still `{code,message,data}`?
+1. Reverse Accepted ADR? → ASK / new ADR.  
+2. Correct layer? Handler / Service / Repository?  
+3. Domain words = `.ai/domain.md` + lexicon for UI?  
+4. Envelope still `{code,message,data}`?  
+5. Local workflow still host runtime（非 Docker-only 编码）?
 
 ## Stop conditions
 
-- Unclear requirement → ASK FIRST
-- Need GraphQL / new DB / new auth scheme → write or cite ADR before coding
+- Unclear requirement → **ASK FIRST**  
+- Need GraphQL / new auth scheme / new datastore → ADR before coding  
+- Urge to “just ALTER TABLE” → write migration instead  
+
+## Playbooks
+
+Prefer: `add-api` · `new-page` · `new-table` · `payment` · `login`