feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

AGENTS.md

@@ -11,15 +11,16 @@ This file is for AI agents.
 3. `.ai/architecture.md`
 4. `.ai/domain.md` (+ product/API tasks: `domain/domain-map.md`)
 5. `.ai/forbidden.md`
-6. `.ai/file-map.md` + `.ai/workflow.md`
-7. Task rules: `.ai/coding.md` / `api.md` / `database.md` / `ui.md` / `security.md` / …
-8. **Product scope:** `.ai/product/lexicon.md` + `feature-map.md` + `user-journey.md` + `page-tree.md`（冻结见 `ENGINEERING-FREEZE.md`）
-9. **Any UI work:** `.ai/design/design-system.md` + `component-catalog.md` + matching `design/platform/*.md` (H5 default)
-10. Matching **ADR** in `.ai/adr/` before changing stack or API style
-11. Prefer **patterns/** + **examples/** + **playbooks/** over inventing structure
-12. Before Done: `.ai/review.md` + `.ai/definition-of-done.md` + `.ai/checklists/*`
-13. Verify via `.ai/commands.md`
-14. `prompts/` are optional helpers — not a substitute for rules above
+6. `.ai/environment.md` + `.ai/development.md`（本地）· 部署任务再读 `deployment.md` / `docker.md`
+7. `.ai/file-map.md` + `.ai/workflow.md`
+8. Task rules: `.ai/coding.md` / `api.md` / `database.md` / `ui.md` / `security.md` / …
+9. **Product scope:** `.ai/product/lexicon.md` + `feature-map.md` + `user-journey.md` + `page-tree.md`（冻结见 `ENGINEERING-FREEZE.md`）
+10. **Any UI work:** `.ai/design/design-system.md` + `component-catalog.md` + matching `design/platform/*.md` (H5 default)
+11. Matching **ADR** in `.ai/adr/` before changing stack or API style
+12. Prefer **patterns/** + **examples/** + **playbooks/** over inventing structure
+13. Before Done: `.ai/review.md` + `.ai/definition-of-done.md` + `.ai/checklists/*`
+14. Verify via `.ai/commands.md`（本地默认本机 Go/Vite + compose.dev 仅 DB）
+15. `prompts/` are optional helpers — not a substitute for rules above
 
 ## Hard constraints
 
@@ -30,6 +31,7 @@ This file is for AI agents.
 - New code only under `apps/` and `packages/` (unless legacy migration task).
 - One concern per change set. Function ≤50 lines. File ≤400 lines.
 - Print the Review block when a coding task finishes.
+- **Never** make Docker-only local coding the default (see `.ai/environment.md`).
 
 ## Cursor