feat(m0): bootstrap repo, design system, compose stack

- Repo scaffolding: .gitignore, .env.example, Makefile, docker-compose.yml,
  README.md, CHANGELOG.md, pre-commit config.
- Three-service stack: api (Flask 3), db (postgres:16-alpine), front (nginx
  serving the Vite bundle). Named volumes metamorph_db + metamorph_evidence.
- Backend skeleton: Flask app factory, JSON structured logging on stdout,
  GET /api/v1/health, multi-stage Dockerfile, pyproject.toml driven by uv,
  Pydantic Settings with secret guard rails (refuses to boot in non-dev with
  placeholders), APP_ENV gating.
- Frontend skeleton: Vite + React 18 + TypeScript strict + TailwindCSS, RTOps
  design tokens from tasks/design.md, self-hosted JetBrains Mono / IBM Plex
  Sans via @fontsource, base UI primitives (Card/Tag/SectionHeader/FlowNode/
  Button), home page wired to /api/v1/health.
- Engine-agnostic Makefile: auto-detects docker or podman, picks the matching
  compose driver. Targets: up/down/build/rebuild/dev/lint/fmt/test/migrate/
  seed-mitre/print-install-token/e2e/inspect-health.
- Playwright suite: e2e/tests/m0-smoke.spec.ts (8 tests) + HTML + JUnit
  reports + traces on retry.
- Docs: tasks/spec.md (finalized after Q&A), tasks/design.md, tasks/todo.md
  (14 milestones), tasks/testing-m0.md, tasks/lessons.md.

DoD: make up + make health + make e2e all pass on podman 5.x (Fedora) and
docker. TLS terminated by external reverse proxy (spec §6 NF-network).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

e2e/playwright.config.ts

@@ -0,0 +1,60 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * Playwright configuration for Metamorph end-to-end tests.
+ *
+ * Run modes:
+ *   1. Against an already-running stack (default in CI/local):
+ *        cd e2e && BASE_URL=http://localhost:8080 npm test
+ *   2. With auto-spawned dev servers — set PW_AUTOSTART=1 (see `webServer` block).
+ *
+ * Reports:
+ *   - HTML report → `e2e/playwright-report/` (open with `npm run report`)
+ *   - JUnit XML  → `e2e/playwright-report/junit.xml` (CI ingestion)
+ *   - Traces and screenshots are kept on retry for forensics.
+ */
+const BASE_URL = process.env.BASE_URL ?? 'http://localhost:8080';
+const AUTOSTART = process.env.PW_AUTOSTART === '1';
+
+export default defineConfig({
+  testDir: './tests',
+  timeout: 30_000,
+  expect: { timeout: 5_000 },
+  // The stack uses a shared Postgres. Each spec that calls /diag/reset wipes
+  // global state, so we must serialise execution to avoid spec-vs-spec races
+  // (notably the install-token reset and the per-spec admin bootstrap).
+  fullyParallel: false,
+  retries: process.env.CI ? 2 : 0,
+  workers: 1,
+  reporter: [
+    ['list'],
+    ['html', { outputFolder: 'playwright-report', open: 'never' }],
+    ['junit', { outputFile: 'playwright-report/junit.xml' }],
+  ],
+  use: {
+    baseURL: BASE_URL,
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+    video: 'retain-on-failure',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+  ],
+  // Optional: spawn the compose stack via `make up` before the tests run.
+  // Disabled by default — rely on the operator to bring the stack up.
+  ...(AUTOSTART
+    ? {
+        webServer: {
+          command: 'cd .. && make up',
+          url: `${BASE_URL}/api/v1/health`,
+          reuseExistingServer: true,
+          timeout: 120_000,
+          stdout: 'pipe',
+          stderr: 'pipe',
+        },
+      }
+    : {}),
+});