feat: phase 0 foundation — FastAPI scaffold + /healthz

Scaffold app/ package, pinned requirements.txt, multi-stage Dockerfile,
docker-compose.yml, and .env.example. Add typed pydantic-settings loader
with full env contract and a production validator that refuses the
dev-sentinel SECRET_KEY. Wire structlog with an APP_ENV-driven renderer
(console in dev, JSON in prod). Ship a minimal unauthenticated /healthz
returning {status, version, commit_sha} with commit SHA fed through a
GIT_COMMIT_SHA build arg.

Also mark Phase 0 complete in docs/ROADMAP.md.

.gitignore

@@ -25,8 +25,11 @@ env/
 *.db-wal
 *.db-shm
 
-# Runtime data (DB + media uploads live here in prod)
-data/
+# Runtime data (DB + media uploads live here in prod).
+# Ignore everything inside data/ except the .gitkeep marker; negating a
+# path whose *directory* is ignored does not work, so we ignore the
+# contents with a trailing glob instead.
+data/*
 !data/.gitkeep
 
 # Editors / IDE