feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/model/profile.go

@@ -0,0 +1,21 @@
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// Profile is a personal archive (self or other).
+type Profile struct {
+	ID           uuid.UUID  `json:"id"`
+	UserID       uuid.UUID  `json:"user_id"`
+	Relation     string     `json:"relation"`
+	DisplayName  string     `json:"display_name"`
+	BirthDate    time.Time  `json:"birth_date"`
+	BirthTime    *string    `json:"birth_time,omitempty"`
+	BirthPlace   *string    `json:"birth_place,omitempty"`
+	Gender       *string    `json:"gender,omitempty"`
+	RelationType *string    `json:"relation_type,omitempty"`
+	CreatedAt    time.Time  `json:"created_at"`
+}

apps/api/internal/model/report.go

@@ -0,0 +1,20 @@
+package model
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// GrowthReport is a deliverable with free summary and gated detail.
+type GrowthReport struct {
+	ID        uuid.UUID       `json:"id"`
+	UserID    uuid.UUID       `json:"user_id"`
+	ProfileID uuid.UUID       `json:"profile_id"`
+	Type      string          `json:"type"`
+	Summary   json.RawMessage `json:"summary"`
+	Detail    json.RawMessage `json:"detail,omitempty"`
+	HasDeep   bool            `json:"has_deep_access"`
+	CreatedAt time.Time       `json:"created_at"`
+}