feat: phase 0 foundation — FastAPI scaffold + /healthz

Scaffold app/ package, pinned requirements.txt, multi-stage Dockerfile,
docker-compose.yml, and .env.example. Add typed pydantic-settings loader
with full env contract and a production validator that refuses the
dev-sentinel SECRET_KEY. Wire structlog with an APP_ENV-driven renderer
(console in dev, JSON in prod). Ship a minimal unauthenticated /healthz
returning {status, version, commit_sha} with commit SHA fed through a
GIT_COMMIT_SHA build arg.

Also mark Phase 0 complete in docs/ROADMAP.md.

app/routes/__init__.py

@@ -0,0 +1,8 @@
+"""HTTP route packages.
+
+Routers live as sibling modules and are wired into the app in
+:mod:`app.main`. Phase 0 only exposes ``health``; public, admin, and auth
+routers arrive in later phases.
+"""
+
+from __future__ import annotations