chore: initial foundation — server skeleton, autodocs, CI

- minimal Axum server exposing GET /health
- OpenAPI contract generated from handlers (gen_openapi -> openapi.json),
  drift-gated in CI so the spec can never silently diverge from the code
- CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny
- Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain
- README, SECURITY.md, deny.toml, .env.example

tools/secret-scan.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# secret-scan: block private keys and seed material from entering the tree.
+#
+# Public-safe by design: it matches on secret *shapes* (key blocks, mnemonic
+# markers), never on project-internal names. gitleaks runs alongside it in CI
+# for broad token/credential patterns.
+#
+#   ./tools/secret-scan.sh
+#
+set -uo pipefail
+cd "$(dirname "$0")/.."
+
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1 && [ -n "$(git ls-files)" ]; then
+  mapfile -t FILES < <(git ls-files)
+else
+  mapfile -t FILES < <(find . -type f -not -path './.git/*' -not -path './target/*' -printf '%P\n')
+fi
+
+# Secret shapes (not names): PEM/OpenSSH/PGP private-key blocks and seed phrases.
+PATTERNS='(-----BEGIN ([A-Z ]+ )?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY|BEGIN OPENSSH PRIVATE KEY|\b(mnemonic|seed[_ ]?phrase)\b\s*[:=])'
+
+fail=0
+for f in "${FILES[@]}"; do
+  [ -f "$f" ] || continue
+  case "$f" in tools/secret-scan.sh) continue ;; esac
+  if grep -EnI "$PATTERNS" "$f" >/dev/null 2>&1; then
+    echo "SECRET-SCAN: possible key/seed material in $f"
+    grep -EnI "$PATTERNS" "$f" | sed 's/^/    /'
+    fail=1
+  fi
+done
+
+if [ "$fail" -ne 0 ]; then
+  echo "SECRET-SCAN FAILED — remove key/seed material before committing."
+  exit 1
+fi
+echo "secret-scan OK (${#FILES[@]} files checked)."