feat: Phase 0 walking skeleton — monorepo, API, web, ML stub

Sets up the full Phase 0 foundation:

- pnpm workspaces + turbo build graph; native module build approval
- packages/shared-types: HTTP contracts (Tip, Auth, Integrations, User)
- services/api: Express modular monolith with better-sqlite3/drizzle
  - auth: Google OAuth2 + PKCE via openid-client v6, cookie sessions
  - integrations: Todoist OAuth2 connect/disconnect, token vault
  - recommender: RandomPolicy over Todoist tasks, feedback sink
  - user: profile, consent capture, full account deletion (GDPR)
- apps/web: Next.js 15, three pages (sign-in → connect → tip)
  - tip page: black canvas, hold-to-act gesture, action sheet
  - PWA manifest + theme
- ml/serving: FastAPI stub implementing the POST /score contract
- infra: docker-compose (core/full profiles), Dockerfiles, CI skeleton
- .env.example with all required vars documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api/src/config.ts

@@ -0,0 +1,32 @@
+import 'dotenv/config';
+
+function require(name: string): string {
+  const val = process.env[name];
+  if (!val) throw new Error(`Missing required env var: ${name}`);
+  return val;
+}
+
+function optional(name: string, fallback: string): string {
+  return process.env[name] ?? fallback;
+}
+
+export const config = {
+  PORT: parseInt(optional('PORT', '3001'), 10),
+  NODE_ENV: optional('NODE_ENV', 'development'),
+  DATABASE_PATH: optional('DATABASE_PATH', './data/oo.db'),
+
+  SESSION_SECRET: require('SESSION_SECRET'),
+
+  GOOGLE_CLIENT_ID: require('GOOGLE_CLIENT_ID'),
+  GOOGLE_CLIENT_SECRET: require('GOOGLE_CLIENT_SECRET'),
+
+  TODOIST_CLIENT_ID: require('TODOIST_CLIENT_ID'),
+  TODOIST_CLIENT_SECRET: require('TODOIST_CLIENT_SECRET'),
+
+  /** Absolute base URL of this API, e.g. http://localhost:3001 */
+  API_BASE_URL: optional('API_BASE_URL', 'http://localhost:3001'),
+  /** Absolute base URL of the web app, e.g. http://localhost:3000 */
+  WEB_BASE_URL: optional('WEB_BASE_URL', 'http://localhost:3000'),
+
+  ML_SERVING_URL: optional('ML_SERVING_URL', 'http://localhost:8000'),
+};