feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/.env.example

@@ -1,4 +1,10 @@
+# Template only — copy to apps/api/.env.local or export in shell.
+# Never commit real secrets. See .ai/environment.md → Configuration Ownership.
+
 APP_ENV=dev
 HTTP_ADDR=:8080
 DATABASE_URL=postgres://yuxingu:yuxingu@127.0.0.1:5432/yuxingu?sslmode=disable
-JWT_SECRET=change-me-in-production
+
+# Optional
+# MIGRATIONS_DIR=./migrations
+# JWT_SECRET=change-me-in-production