chore: initial foundation — server skeleton, autodocs, CI

- minimal Axum server exposing GET /health
- OpenAPI contract generated from handlers (gen_openapi -> openapi.json),
  drift-gated in CI so the spec can never silently diverge from the code
- CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny
- Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain
- README, SECURITY.md, deny.toml, .env.example

src/bin/gen_openapi.rs

@@ -0,0 +1,20 @@
+//! Emit the OpenAPI 3 specification to stdout.
+//!
+//! The spec is derived from the handlers (`utoipa` annotations) and is the
+//! single source of truth for the API contract and the generated TypeScript
+//! client. Regenerate the committed contract with:
+//!
+//!     cargo run --bin gen_openapi > openapi.json
+//!
+//! CI regenerates and diffs against the committed `openapi.json`; a drift is a
+//! failed build, not a stale doc.
+
+use smirk_backend_core::api::openapi::ApiDoc;
+use utoipa::OpenApi;
+
+fn main() {
+    let spec = ApiDoc::openapi()
+        .to_pretty_json()
+        .expect("serialize OpenAPI spec");
+    println!("{spec}");
+}