feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/model/report.go

@@ -0,0 +1,20 @@
+package model
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// GrowthReport is a deliverable with free summary and gated detail.
+type GrowthReport struct {
+	ID        uuid.UUID       `json:"id"`
+	UserID    uuid.UUID       `json:"user_id"`
+	ProfileID uuid.UUID       `json:"profile_id"`
+	Type      string          `json:"type"`
+	Summary   json.RawMessage `json:"summary"`
+	Detail    json.RawMessage `json:"detail,omitempty"`
+	HasDeep   bool            `json:"has_deep_access"`
+	CreatedAt time.Time       `json:"created_at"`
+}