Phase 0 milestone 0.1: repo scaffold + Docker Compose

Scaffolding for the YPMS in-house build. Mirrors OWC's structure so
future OWC framework code can be vendored in with minimal fiddling
(milestone 0.2).

Includes:

- pyproject.toml — Python 3.12, FastAPI, SQLAlchemy 2.x, Alembic,
  Postgres, pydantic-settings, structlog, cryptography. Dev extras:
  pytest, ruff, mypy, bandit, pip-audit.
- Dockerfile — multi-stage builder + slim runtime.
- docker-compose.yml — app + Postgres (on 5433 to avoid clashing with
  OWC on 5432) + Adminer (on 8081).
- alembic.ini + migrations/env.py + baseline 0001_baseline.py (empty
  by design; every future change is additive and immutable once merged).
- src/ypms/main.py — FastAPI factory with /healthz and /readyz.
- src/ypms/settings.py — pydantic-settings config (DB URL, JWT,
  column encryption key, log level, env, CORS).
- src/ypms/logging.py — structlog + sanitize_for_log() for the
  sensitive-fields-never-in-logs rule from ARCHITECTURE.md §10.1.
- src/ypms/db.py — SQLAlchemy Base, engine, session factory, get_db.
- src/ypms/middleware.py — RequestIdMiddleware; X-Request-ID header
  echoed both ways.
- src/ypms/framework/ and src/ypms/security/ — empty packages, to be
  populated in milestones 0.2 and 0.3-0.4.
- tests/test_health.py — 3 smoke tests (healthz OK, header present,
  header honoured on incoming).
- README.md — quickstart.
- CONTRIBUTING.md — hard rules mirrored from OWC.
- .github/workflows/ci.yml — lint (ruff), types (mypy), tests + 80%
  coverage floor, SAST (bandit), SCA (pip-audit), gitleaks.

Green locally: ruff clean, mypy clean, pytest 3 passed.

Advances YPMS-POAM-040 (architecture doc + Phase 0 kickoff).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,27 @@
+# YPMS local development environment
+#
+# Copy this file to .env for local runs. Do NOT commit .env.
+# Production values live in Azure Key Vault (Phase 1+).
+
+# ---- Database ----
+# Local (host) → Postgres exposed on 5433 to avoid clashing with OWC on 5432
+DATABASE_URL=postgresql+psycopg://ypms:ypms@localhost:5433/ypms
+
+# ---- JWT ----
+JWT_SECRET=dev-secret-change-me
+JWT_ALG=HS256
+ACCESS_TOKEN_TTL_MINUTES=60
+REFRESH_TOKEN_TTL_DAYS=14
+
+# ---- App-layer column encryption ----
+# Phase 0: local key material only. Phase 1 swaps to Azure Key Vault.
+# Any 32-byte value in dev. Never use this string in staging/prod.
+COLUMN_ENCRYPTION_KEY=dev-col-enc-key-change-me-32bytes-______
+
+# ---- Logging + environment ----
+LOG_LEVEL=INFO
+ENV=dev
+
+# ---- CORS (dev only) ----
+# Comma-separated origins allowed to hit the API from a browser.
+CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173