feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.dev.yml

@@ -0,0 +1,30 @@
+# Local dependency services ONLY — not for building/running api or user-h5.
+# Policy: .ai/docker.md · .ai/development.md
+#
+#   docker compose -f docker-compose.dev.yml up -d
+#   docker compose -f docker-compose.dev.yml down
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: yuxingu-postgres
+    environment:
+      POSTGRES_USER: yuxingu
+      POSTGRES_PASSWORD: yuxingu
+      POSTGRES_DB: yuxingu
+    ports:
+      - "5432:5432"
+    volumes:
+      - yuxingu_pg_dev:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U yuxingu -d yuxingu"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # redis:
+  #   image: redis:7-alpine
+  #   ports: ["6379:6379"]
+
+volumes:
+  yuxingu_pg_dev: