feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

CONTRIBUTING.md

@@ -2,30 +2,39 @@
 
 ## AI-first
 
-This project is driven by the **AI Engineering System** under [`.ai/`](.ai/).  
-Agents must load [AGENTS.md](AGENTS.md) and `.ai/*` before coding.
+本仓库由 [`.ai/`](.ai/) 约束。入口：[AGENTS.md](AGENTS.md)。
 
-Human product docs (PRD, business) stay in `apps/docs/`.  
-Do **not** treat `apps/docs/standards/` as the source of truth — it only points here for history.
+环境分流（必读）：
 
-## Local
+- [`.ai/environment.md`](.ai/environment.md) — Local / CI / Prod 分离  
+- [`.ai/development.md`](.ai/development.md) — 本地本机 Go + Vite  
+- [`.ai/docker.md`](.ai/docker.md) — Docker 只做依赖与部署  
+- [`.ai/deployment.md`](.ai/deployment.md) — 生产不可变镜像  
+
+## Local（默认）
 
 ```bash
-# optional CN Go proxy
-export GOPROXY=https://goproxy.cn,direct
+# 1) 依赖服务 only
+docker compose -f docker-compose.dev.yml up -d
 
-cd apps/api && go mod tidy && go run ./cmd/server
+# 2) API — 本机 Go（不要 docker build api）
+export GOPROXY=https://goproxy.cn,direct   # 如需要
+cd apps/api && go run ./cmd/server
+# 可选热更: air
+
+# 3) H5 — 本机 Vite（不要 docker build web）
 npm install && npm run dev:h5
-docker compose -f deploy/docker-compose.yml up -d   # postgres
 ```
 
+- API: http://127.0.0.1:8080/api/v1/healthz  
+- H5: http://127.0.0.1:5173  
+
 ## Git
 
-Trunk-Based: short `feature/*` / `fix/*` into `main`.  
-Commits: Conventional Commits (`feat:`, `fix:`, `docs:`, …).
+Trunk-Based；Conventional Commits（`feat:` / `fix:` / `docs:` …）。
 
 ## PR
 
-- One feature point.
-- Include Review checklist results when AI-assisted.
-- API changes update `proto/openapi.yaml`.
+- 一个功能点。  
+- API 变更同步 `proto/openapi.yaml`。  
+- 勿把「本地必须全量 compose 起 api/web」写进新文档。