feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000001_init.down.sql

@@ -0,0 +1,9 @@
+DROP TABLE IF EXISTS deep_accesses;
+DROP TABLE IF EXISTS payments;
+DROP TABLE IF EXISTS orders;
+DROP TABLE IF EXISTS memberships;
+DROP TABLE IF EXISTS growth_reports;
+DROP TABLE IF EXISTS profiles;
+DROP TABLE IF EXISTS device_identities;
+DROP TABLE IF EXISTS users;
+DROP TABLE IF EXISTS schema_migrations;