feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/cmd/server/main.go

@@ -2,14 +2,21 @@
 package main
 
 import (
+	"context"
 	"log"
 	"os"
+	"path/filepath"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"github.com/yuxingu/digital-psychology/apps/api/internal/config"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/db"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/handler"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/profile"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/report"
 	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
 )
 
@@ -19,20 +26,52 @@ func main() {
 		gin.SetMode(gin.ReleaseMode)
 	}
 
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	pool, err := db.Connect(ctx, cfg.DatabaseURL)
+	if err != nil {
+		log.Printf("database unavailable: %v", err)
+		log.Printf("hint: docker compose -f deploy/docker-compose.yml up -d")
+		os.Exit(1)
+	}
+	defer pool.Close()
+
+	migDir := os.Getenv("MIGRATIONS_DIR")
+	if migDir == "" {
+		migDir = filepath.Join("migrations")
+	}
+	if err := db.Migrate(ctx, pool, migDir); err != nil {
+		log.Printf("migrate: %v", err)
+		os.Exit(1)
+	}
+
+	profileSvc := &profile.Service{Repo: &repository.ProfileRepo{Pool: pool}}
+	reportSvc := &report.Service{
+		Profiles: &repository.ProfileRepo{Pool: pool},
+		Reports:  &repository.ReportRepo{Pool: pool},
+	}
+
 	r := gin.New()
 	r.Use(gin.Recovery(), gin.Logger(), middleware.RequestID())
+	r.Use(func(c *gin.Context) {
+		c.Header("Access-Control-Expose-Headers", "X-Device-Key, X-Request-Id")
+		c.Next()
+	})
 
 	api := r.Group("/api/v1")
 	handler.NewHealthHandler().Register(api)
-
-	// Placeholder route to demonstrate unified envelope.
 	api.GET("/ping", func(c *gin.Context) {
 		response.OK(c, gin.H{"pong": true})
 	})
 
-	addr := cfg.HTTPAddr
-	log.Printf("yuxingu api listening on %s env=%s", addr, cfg.AppEnv)
-	if err := r.Run(addr); err != nil {
+	authed := api.Group("")
+	authed.Use(middleware.DeviceAuth(pool))
+	(&handler.ProfileHandler{Svc: profileSvc}).Register(authed)
+	(&handler.ReportHandler{Svc: reportSvc}).Register(authed)
+
+	log.Printf("yuxingu api listening on %s env=%s", cfg.HTTPAddr, cfg.AppEnv)
+	if err := r.Run(cfg.HTTPAddr); err != nil {
 		log.Printf("server stopped: %v", err)
 		os.Exit(1)
 	}