chore(01-01): scaffold monorepo, Docker Compose stack, and Vitest harness

- pnpm workspace with apps/api (Hono/Drizzle) and apps/pwa (Vite/React 19)
- Pinned versions per RESEARCH: hono@4.12.23, drizzle-orm@0.45.2, mysql2@3.22.4, tsdav@2.2.2, ical.js@2.2.1, zod@^3.25.0, node-cron@^4.2.1
- docker-compose.yml with mariadb:11 healthcheck, api depends_on service_healthy, redis stub
- docker-compose.dev.yml overrides for local dev (bind mounts, exposed ports)
- .env.example lists all env vars (DB_*, OIDC_*, APP_PASSWORD_ENCRYPTION_KEY)
- .gitignore excludes .env (never commit secrets)
- apps/api/vitest.config.ts with environment: node
- Wave 0 test stubs: health, auth/user, broker/crypto, broker/sync, broker/poller

apps/api/tests/auth/user.test.ts

@@ -0,0 +1,22 @@
+/**
+ * Wave 0 stub — Auth: upsertUser color round-robin + identity stability
+ *
+ * These tests are RED stubs. Implementation lives in:
+ *   apps/api/src/auth/user.ts  (Plan 02)
+ *
+ * Tests will be filled GREEN in Plan 02 when upsertUser is implemented.
+ */
+
+import { describe, it } from 'vitest'
+
+describe('upsertUser', () => {
+  it.todo('assigns a color from the palette on first login (Plan 02)')
+
+  it.todo('returns the same color on subsequent logins for the same oidc identity (Plan 02)')
+
+  it.todo('assigns distinct colors to two different users (Plan 02)')
+
+  it.todo('uses oidc_iss + oidc_sub as the composite identity key, not email (Plan 02)')
+
+  it.todo('returns the full user row including id, color, displayName (Plan 02)')
+})