chore(01-01): scaffold monorepo, Docker Compose stack, and Vitest harness

- pnpm workspace with apps/api (Hono/Drizzle) and apps/pwa (Vite/React 19)
- Pinned versions per RESEARCH: hono@4.12.23, drizzle-orm@0.45.2, mysql2@3.22.4, tsdav@2.2.2, ical.js@2.2.1, zod@^3.25.0, node-cron@^4.2.1
- docker-compose.yml with mariadb:11 healthcheck, api depends_on service_healthy, redis stub
- docker-compose.dev.yml overrides for local dev (bind mounts, exposed ports)
- .env.example lists all env vars (DB_*, OIDC_*, APP_PASSWORD_ENCRYPTION_KEY)
- .gitignore excludes .env (never commit secrets)
- apps/api/vitest.config.ts with environment: node
- Wave 0 test stubs: health, auth/user, broker/crypto, broker/sync, broker/poller

.env.example

@@ -0,0 +1,19 @@
+# Database
+DB_HOST=mariadb
+DB_PORT=3306
+DB_USER=familysync
+DB_PASSWORD=
+DB_NAME=familysync
+DB_ROOT_PASSWORD=
+
+# OIDC (Authelia) — fill in after registering the client
+OIDC_AUTH_SECRET=
+OIDC_ISSUER=
+OIDC_CLIENT_ID=familysync
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=https://familysync.yourdomain.com/callback
+OIDC_AUTH_EXTERNAL_URL=https://familysync.yourdomain.com
+
+# CalDAV broker encryption key — generate with:
+# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+APP_PASSWORD_ENCRYPTION_KEY=