chore: initial foundation — server skeleton, autodocs, CI

- minimal Axum server exposing GET /health
- OpenAPI contract generated from handlers (gen_openapi -> openapi.json),
  drift-gated in CI so the spec can never silently diverge from the code
- CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny
- Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain
- README, SECURITY.md, deny.toml, .env.example

src/api/mod.rs

@@ -0,0 +1,4 @@
+//! HTTP API layer: handlers and the OpenAPI assembly.
+
+pub mod health;
+pub mod openapi;