feat(m0): bootstrap repo, design system, compose stack

- Repo scaffolding: .gitignore, .env.example, Makefile, docker-compose.yml,
  README.md, CHANGELOG.md, pre-commit config.
- Three-service stack: api (Flask 3), db (postgres:16-alpine), front (nginx
  serving the Vite bundle). Named volumes metamorph_db + metamorph_evidence.
- Backend skeleton: Flask app factory, JSON structured logging on stdout,
  GET /api/v1/health, multi-stage Dockerfile, pyproject.toml driven by uv,
  Pydantic Settings with secret guard rails (refuses to boot in non-dev with
  placeholders), APP_ENV gating.
- Frontend skeleton: Vite + React 18 + TypeScript strict + TailwindCSS, RTOps
  design tokens from tasks/design.md, self-hosted JetBrains Mono / IBM Plex
  Sans via @fontsource, base UI primitives (Card/Tag/SectionHeader/FlowNode/
  Button), home page wired to /api/v1/health.
- Engine-agnostic Makefile: auto-detects docker or podman, picks the matching
  compose driver. Targets: up/down/build/rebuild/dev/lint/fmt/test/migrate/
  seed-mitre/print-install-token/e2e/inspect-health.
- Playwright suite: e2e/tests/m0-smoke.spec.ts (8 tests) + HTML + JUnit
  reports + traces on retry.
- Docs: tasks/spec.md (finalized after Q&A), tasks/design.md, tasks/todo.md
  (14 milestones), tasks/testing-m0.md, tasks/lessons.md.

DoD: make up + make health + make e2e all pass on podman 5.x (Fedora) and
docker. TLS terminated by external reverse proxy (spec §6 NF-network).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,31 @@
+# Copy to `.env` and fill in real values. Never commit `.env`.
+
+# === Runtime mode ===
+# `dev` allows the placeholder secrets below (only on a workstation).
+# Anything else (`prod`, `staging`) forces strong values — the API refuses to boot otherwise.
+APP_ENV=dev
+
+# === Postgres ===
+POSTGRES_DB=metamorph
+POSTGRES_USER=metamorph
+POSTGRES_PASSWORD=change-me-strong
+POSTGRES_HOST=db
+POSTGRES_PORT=5432
+
+# === Backend (Flask API) ===
+# Generate with: python -c "import secrets; print(secrets.token_urlsafe(64))"
+JWT_SECRET=change-me-to-a-long-random-string
+LOG_LEVEL=INFO
+# Comma-separated list of allowed origins for CORS (no trailing slash)
+FRONT_ORIGIN=http://localhost:8080
+# Where uploaded evidence files are stored inside the api container
+EVIDENCE_DIR=/data/evidence
+
+# === Frontend (build-time) ===
+# Base URL the front uses to reach the API. In compose the nginx of the front
+# proxies /api/* to the api service, so an empty/relative value is fine.
+VITE_API_BASE_URL=/api/v1
+
+# === Compose port mappings (host side) ===
+HOST_API_PORT=8000
+HOST_FRONT_PORT=8080