feat: Phase 0 walking skeleton — monorepo, API, web, ML stub

Sets up the full Phase 0 foundation:

- pnpm workspaces + turbo build graph; native module build approval
- packages/shared-types: HTTP contracts (Tip, Auth, Integrations, User)
- services/api: Express modular monolith with better-sqlite3/drizzle
  - auth: Google OAuth2 + PKCE via openid-client v6, cookie sessions
  - integrations: Todoist OAuth2 connect/disconnect, token vault
  - recommender: RandomPolicy over Todoist tasks, feedback sink
  - user: profile, consent capture, full account deletion (GDPR)
- apps/web: Next.js 15, three pages (sign-in → connect → tip)
  - tip page: black canvas, hold-to-act gesture, action sheet
  - PWA manifest + theme
- ml/serving: FastAPI stub implementing the POST /score contract
- infra: docker-compose (core/full profiles), Dockerfiles, CI skeleton
- .env.example with all required vars documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/lib/api.ts

@@ -0,0 +1,64 @@
+import type { RecommendResponse, TipFeedback, IntegrationsResponse, UserProfile } from '@oo/shared-types';
+
+const API = '/api';
+
+async function apiFetch<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(`${API}${path}`, {
+    credentials: 'include',
+    ...init,
+    headers: {
+      'Content-Type': 'application/json',
+      ...init?.headers,
+    },
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: res.statusText }));
+    throw Object.assign(new Error(err.error ?? 'API error'), { status: res.status });
+  }
+  if (res.status === 204) return undefined as T;
+  return res.json() as T;
+}
+
+export async function getSession() {
+  return apiFetch<{ user: { id: string; email: string; name?: string; image?: string } | null }>('/auth/session');
+}
+
+export async function getRecommendation(): Promise<RecommendResponse | null> {
+  try {
+    return await apiFetch<RecommendResponse>('/recommend', { method: 'POST' });
+  } catch (e: any) {
+    if (e.status === 204 || e.status === 422) return null;
+    throw e;
+  }
+}
+
+export async function sendFeedback(tipId: string, feedback: TipFeedback) {
+  return apiFetch<{ ok: boolean }>(`/tip/${encodeURIComponent(tipId)}/feedback`, {
+    method: 'POST',
+    body: JSON.stringify(feedback),
+  });
+}
+
+export async function getIntegrations(): Promise<IntegrationsResponse> {
+  return apiFetch<IntegrationsResponse>('/integrations');
+}
+
+export async function disconnectIntegration(provider: string) {
+  return apiFetch<{ ok: boolean }>(`/integrations/${provider}`, { method: 'DELETE' });
+}
+
+export async function getProfile(): Promise<UserProfile> {
+  return apiFetch<UserProfile>('/user/me');
+}
+
+export async function giveConsent() {
+  return apiFetch<{ ok: boolean }>('/user/consent', { method: 'POST' });
+}
+
+export async function deleteAccount() {
+  return apiFetch<{ ok: boolean }>('/user/me', { method: 'DELETE' });
+}
+
+export async function logout() {
+  return apiFetch<{ ok: boolean }>('/auth/logout', { method: 'POST' });
+}