feat: phase 0 foundation — FastAPI scaffold + /healthz

Scaffold app/ package, pinned requirements.txt, multi-stage Dockerfile,
docker-compose.yml, and .env.example. Add typed pydantic-settings loader
with full env contract and a production validator that refuses the
dev-sentinel SECRET_KEY. Wire structlog with an APP_ENV-driven renderer
(console in dev, JSON in prod). Ship a minimal unauthenticated /healthz
returning {status, version, commit_sha} with commit SHA fed through a
GIT_COMMIT_SHA build arg.

Also mark Phase 0 complete in docs/ROADMAP.md.

app/services/__init__.py

@@ -0,0 +1,7 @@
+"""Application services (auth, email, cache, markdown, media, hcaptcha).
+
+Populated phase-by-phase per ``docs/ROADMAP.md``. Intentionally empty in
+Phase 0.
+"""
+
+from __future__ import annotations