feat: Phase 0 walking skeleton — monorepo, API, web, ML stub

Sets up the full Phase 0 foundation:

- pnpm workspaces + turbo build graph; native module build approval
- packages/shared-types: HTTP contracts (Tip, Auth, Integrations, User)
- services/api: Express modular monolith with better-sqlite3/drizzle
  - auth: Google OAuth2 + PKCE via openid-client v6, cookie sessions
  - integrations: Todoist OAuth2 connect/disconnect, token vault
  - recommender: RandomPolicy over Todoist tasks, feedback sink
  - user: profile, consent capture, full account deletion (GDPR)
- apps/web: Next.js 15, three pages (sign-in → connect → tip)
  - tip page: black canvas, hold-to-act gesture, action sheet
  - PWA manifest + theme
- ml/serving: FastAPI stub implementing the POST /score contract
- infra: docker-compose (core/full profiles), Dockerfiles, CI skeleton
- .env.example with all required vars documented

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/api/src/routes/recommender.ts

@@ -0,0 +1,116 @@
+import { type Router as ExpressRouter, Router, Response } from 'express';
+import { nanoid } from 'nanoid';
+import { db } from '../db/index.js';
+import { integrationTokens, tipFeedback } from '../db/schema.js';
+import { eq, and } from 'drizzle-orm';
+import { requireAuth, AuthenticatedRequest } from '../middleware/session.js';
+import type { Tip } from '@oo/shared-types';
+
+const router: ExpressRouter = Router();
+
+/** Fetch active Todoist tasks for a user via their stored token */
+async function fetchTodoistTasks(accessToken: string): Promise<Tip[]> {
+  const res = await fetch('https://api.todoist.com/rest/v2/tasks?filter=today|overdue', {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  });
+
+  if (!res.ok) return [];
+
+  const tasks = (await res.json()) as Array<{
+    id: string;
+    content: string;
+    due?: { string: string };
+  }>;
+
+  return tasks.map((t) => ({
+    id: `todoist:${t.id}`,
+    content: t.content,
+    source: 'todoist' as const,
+    sourceId: t.id,
+    createdAt: new Date().toISOString(),
+  }));
+}
+
+/**
+ * RandomPolicy — picks one task at random from the candidate set.
+ * Contract: same interface the ML scorer will implement.
+ */
+function randomPolicy(candidates: Tip[]): Tip | null {
+  if (!candidates.length) return null;
+  return candidates[Math.floor(Math.random() * candidates.length)];
+}
+
+/** POST /api/recommend */
+router.post('/', requireAuth, async (req: AuthenticatedRequest, res: Response) => {
+  const [token] = await db
+    .select()
+    .from(integrationTokens)
+    .where(
+      and(
+        eq(integrationTokens.userId, req.userId!),
+        eq(integrationTokens.provider, 'todoist'),
+      ),
+    )
+    .limit(1);
+
+  if (!token) {
+    res.status(422).json({ error: 'No integrations connected' });
+    return;
+  }
+
+  const candidates = await fetchTodoistTasks(token.accessToken);
+  const tip = randomPolicy(candidates);
+
+  if (!tip) {
+    res.status(204).end();
+    return;
+  }
+
+  res.json({ tip });
+});
+
+/** POST /api/tip/:id/feedback */
+router.post('/tip/:id/feedback', requireAuth, async (req: AuthenticatedRequest, res: Response) => {
+  const { action } = req.body as { action: string };
+  const tipId = String(req.params.id);
+
+  if (!['done', 'dismiss', 'snooze'].includes(action)) {
+    res.status(400).json({ error: 'Invalid action' });
+    return;
+  }
+
+  await db.insert(tipFeedback).values({
+    id: nanoid(),
+    userId: req.userId!,
+    tipId,
+    action,
+    sourceId: tipId.startsWith('todoist:') ? tipId.slice(8) : null,
+    createdAt: new Date().toISOString(),
+  });
+
+  // If done, mark complete in Todoist
+  if (action === 'done' && tipId.startsWith('todoist:')) {
+    const todoistId = tipId.slice(8);
+    const [token] = await db
+      .select()
+      .from(integrationTokens)
+      .where(
+        and(
+          eq(integrationTokens.userId, req.userId!),
+          eq(integrationTokens.provider, 'todoist'),
+        ),
+      )
+      .limit(1);
+
+    if (token) {
+      await fetch(`https://api.todoist.com/rest/v2/tasks/${todoistId}/close`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token.accessToken}` },
+      }).catch(() => {});
+    }
+  }
+
+  res.json({ ok: true });
+});
+
+export { router as recommenderRouter };