#1: implement F0 foundation - monorepo, migrations, Go domain layer, service skeletons, CI

Stands up the LambdaMail monorepo per PLAN.md's F0 milestone: local dev
scaffolding (.env.example, Makefile, .gitignore excluding PLAN.md/docs/
.superpowers/), the full initial Postgres schema as a golang-migrate
migration, the complete Go domain layer for services/protocols (value
objects, entities, domain events - zero external imports beyond
github.com/google/uuid) with unit tests, health-checked service skeletons
for auth/storage (TypeScript) and webmail (Next.js), a local
docker-compose.yaml wiring all services together, a language-enforcement
lint script, and a GitHub Actions CI workflow.

Built via 11 sequential tasks under subagent-driven development, each with
an independent implementer + reviewer cycle. Fixes applied during review:
DomainName.IsPunycode() added to satisfy the promised interface; ioredis
default-import typing under NodeNext; next.js bumped 15.0.3->15.5.21 to
resolve high/critical CVEs; lang-lint.mjs corrected to not flag its own
banned-terms list; web service healthcheck added so compose --wait
actually waits on it; webmail Dockerfile's missing public/ directory:
protocols go.mod version aligned with CI's Go 1.22 pin.

Known follow-ups for later phases (not blocking F0): go-arch-lint isn't
wired into CI yet; live docker compose up and migration apply have not
been exercised in this dev environment (no Docker/psql available here)
and will get their first real run in CI, which does have Docker.

.env.example

@@ -0,0 +1,27 @@
+# --- Postgres ---
+POSTGRES_DB=lambdamail
+POSTGRES_USER=lambdamail
+POSTGRES_PASSWORD=change-me-in-local-dev
+
+# --- Redis ---
+REDIS_PASSWORD=change-me-in-local-dev
+
+# --- Shared secrets (local dev values — never reuse in production) ---
+JWT_SECRET=local-dev-jwt-secret-change-me
+LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-min
+
+# --- Cloudflare (optional in F0 — DNS automation lands in F3) ---
+CLOUDFLARE_API_TOKEN=
+
+# --- Host identity ---
+PRIMARY_MAIL_HOST=mail.localhost
+PUBLIC_IPV4=127.0.0.1
+PUBLIC_IPV6=
+
+# --- TLS (F0 has no real certs — protocols stub reports degraded, never crashes) ---
+TLS_MODE=traefik
+COOLIFY_PROXY_DIR=./local/acme
+
+# --- Webmail ---
+WEBMAIL_HOST=localhost:3000
+ADMIN_HOST=