feat: Phase 0 walking skeleton — monorepo, API, web, ML stub

Sets up the full Phase 0 foundation:

- pnpm workspaces + turbo build graph; native module build approval
- packages/shared-types: HTTP contracts (Tip, Auth, Integrations, User)
- services/api: Express modular monolith with better-sqlite3/drizzle
  - auth: Google OAuth2 + PKCE via openid-client v6, cookie sessions
  - integrations: Todoist OAuth2 connect/disconnect, token vault
  - recommender: RandomPolicy over Todoist tasks, feedback sink
  - user: profile, consent capture, full account deletion (GDPR)
- apps/web: Next.js 15, three pages (sign-in → connect → tip)
  - tip page: black canvas, hold-to-act gesture, action sheet
  - PWA manifest + theme
- ml/serving: FastAPI stub implementing the POST /score contract
- infra: docker-compose (core/full profiles), Dockerfiles, CI skeleton
- .env.example with all required vars documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,18 @@
+# Copy to .env.local and fill in values — never commit .env.local
+
+# API
+SESSION_SECRET=change-me-to-a-random-32-char-string
+PORT=3001
+NODE_ENV=development
+DATABASE_PATH=./data/oo.db
+API_BASE_URL=http://localhost:3001
+WEB_BASE_URL=http://localhost:3000
+ML_SERVING_URL=http://localhost:8000
+
+# Google OAuth — https://console.cloud.google.com/
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Todoist OAuth — https://developer.todoist.com/appconsole.html
+TODOIST_CLIENT_ID=
+TODOIST_CLIENT_SECRET=