chore: initial foundation — server skeleton, autodocs, CI

- minimal Axum server exposing GET /health
- OpenAPI contract generated from handlers (gen_openapi -> openapi.json),
  drift-gated in CI so the spec can never silently diverge from the code
- CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny
- Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain
- README, SECURITY.md, deny.toml, .env.example

.gitignore

@@ -0,0 +1,32 @@
+# Rust build artifacts
+/target
+**/*.rs.bk
+
+# Cargo.lock IS tracked — this is a deployable binary, so we want reproducible builds.
+# (Do not ignore it.)
+
+# Environment / secrets — never commit anything but the example.
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+secrets/
+secret_store/
+
+# Runtime / data
+*.log
+data/
+*.sqlite
+*.db
+
+# Tor hidden-service keys (admin onion) must never enter the repo.
+tor/
+hs_ed25519_secret_key
+
+# Editor / OS
+.DS_Store
+.idea/
+.vscode/
+*.swp