feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/.env.example

@@ -1,4 +1,10 @@
+# Template only — copy to apps/api/.env.local or export in shell.
+# Never commit real secrets. See .ai/environment.md → Configuration Ownership.
+
 APP_ENV=dev
 HTTP_ADDR=:8080
 DATABASE_URL=postgres://yuxingu:yuxingu@127.0.0.1:5432/yuxingu?sslmode=disable
-JWT_SECRET=change-me-in-production
+
+# Optional
+# MIGRATIONS_DIR=./migrations
+# JWT_SECRET=change-me-in-production

deploy/README.md

@@ -0,0 +1,11 @@
+# Deploy & local deps
+
+| File | Use |
+|---|---|
+| `../docker-compose.dev.yml` | **Local**：Postgres（及日后 Redis） |
+| `docker-compose.yml` | 兼容入口 → include dev compose |
+| `docker-compose.prod.yml` | 生产（待发布任务添加） |
+| `Dockerfile.*` | 生产/CI 镜像（待发布任务添加） |
+| `.env.example` | 环境变量模板 |
+
+日常写代码：本机 Go + Vite；Docker 只起依赖。见 `.ai/development.md`。

deploy/docker-compose.prod.yml

@@ -0,0 +1,25 @@
+# Production compose skeleton — NOT for daily local coding.
+# Activate only when images/Dockerfiles exist for a release.
+# Policy: .ai/deployment.md · .ai/docker.md
+#
+# Example (uncomment and set registry tags when shipping):
+#
+# services:
+#   api:
+#     image: registry.example.com/yuxingu-api:${TAG:-v0.0.0}
+#     env_file: [.env.prod]
+#     ports: ["8080:8080"]
+#   web:
+#     image: registry.example.com/yuxingu-user-h5:${TAG:-v0.0.0}
+#     ports: ["80:80"]
+
+services:
+  # Keeps file valid; profile "prod" must be enabled explicitly — never default local.
+  postgres:
+    profiles: ["prod"]
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: yuxingu
+      POSTGRES_PASSWORD: change-me
+      POSTGRES_DB: yuxingu
+    # Do not expose 5432 publicly in real prod without network policy.

deploy/docker-compose.yml

@@ -1,3 +1,9 @@
+# Compatibility alias for local dependency services.
+# Prefer from repo root:
+#   docker compose -f docker-compose.dev.yml up -d
+#
+# Does NOT run api or user-h5. Policy: .ai/docker.md
+
 services:
   postgres:
     image: postgres:16-alpine
@@ -9,7 +15,12 @@ services:
     ports:
       - "5432:5432"
     volumes:
-      - yuxingu_pg:/var/lib/postgresql/data
+      - yuxingu_pg_dev:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U yuxingu -d yuxingu"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
 
 volumes:
-  yuxingu_pg:
+  yuxingu_pg_dev: