feat: P1 profile/portrait API and freeze local-dev environment

Add host-first environment contracts (Local vs CI vs Prod), deps-only
compose, and the Profile → Portrait → deep-access mock payment slice
with device identity and auto-migrate on API startup.

Co-authored-by: Cursor <cursoragent@cursor.com>

package.json

@@ -9,6 +9,9 @@
   "scripts": {
     "dev:h5": "npm run dev -w @yuxingu/user-h5",
     "build:h5": "npm run build -w @yuxingu/user-h5",
-    "dev:api": "cd apps/api && go run ./cmd/server"
+    "dev:api": "cd apps/api && go run ./cmd/server",
+    "deps:up": "docker compose -f docker-compose.dev.yml up -d",
+    "deps:down": "docker compose -f docker-compose.dev.yml down",
+    "deps:ps": "docker compose -f docker-compose.dev.yml ps"
   }
 }