feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/profile.go

@@ -0,0 +1,72 @@
+package handler
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/profile"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// ProfileHandler exposes personal archive APIs.
+type ProfileHandler struct {
+	Svc *profile.Service
+}
+
+// Register mounts profile routes (requires device auth on group).
+func (h *ProfileHandler) Register(rg *gin.RouterGroup) {
+	rg.GET("/profiles", h.List)
+	rg.POST("/profiles", h.Create)
+}
+
+type createProfileReq struct {
+	Relation     string  `json:"relation" binding:"required"`
+	DisplayName  string  `json:"display_name"`
+	BirthDate    string  `json:"birth_date" binding:"required"`
+	RelationType *string `json:"relation_type"`
+}
+
+// Create handles POST /profiles.
+func (h *ProfileHandler) Create(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var req createProfileReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	birth, err := time.Parse("2006-01-02", req.BirthDate)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "birth_date must be YYYY-MM-DD")
+		return
+	}
+	p, err := h.Svc.Create(c.Request.Context(), userID, profile.CreateInput{
+		Relation: req.Relation, DisplayName: req.DisplayName, BirthDate: birth, RelationType: req.RelationType,
+	})
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 30001, err.Error())
+		return
+	}
+	response.OK(c, p)
+}
+
+// List handles GET /profiles.
+func (h *ProfileHandler) List(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	list, err := h.Svc.List(c.Request.Context(), userID)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50002, "list failed")
+		return
+	}
+	response.OK(c, gin.H{"items": list})
+}