feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/.air.toml

@@ -0,0 +1,21 @@
+# Optional hot reload: install `air`, then run from apps/api: air
+# https://github.com/air-verse/air
+# Local only — never use as production process manager.
+# Policy: .ai/development.md
+
+root = "."
+tmp_dir = "tmp"
+
+[build]
+  cmd = "go build -o ./tmp/main ./cmd/server"
+  bin = "./tmp/main"
+  include_ext = ["go", "tpl", "tmpl", "html"]
+  exclude_dir = ["tmp", "vendor", "testdata"]
+  delay = 800
+  stop_on_error = true
+
+[log]
+  time = false
+
+[misc]
+  clean_on_exit = true