chore: initial monorepo scaffold + WDS Phase 1+2 artifacts

- Nx 22.7 monorepo (pnpm 11.1, TypeScript 5.9, Node 24)
- apps/api: NestJS 11 (CJS conforme CODING-RULES.md PGD-DB-004)
- apps/web: React 19 + Vite 8 (ESM)
- libs/shared/api-interface: Zod contract base
- Docker Compose dev: Postgres 18, Valkey 8, MinIO, Mailpit
- WDS artifacts:
  - design-artifacts/A-Product-Brief/ (5 docs canônicos + 16 dialogs)
  - design-artifacts/B-Trigger-Map/ (hub + 4 personas + feature impact)
- Stack canon: STACK.md v2.2 + CODING-RULES.md v2.0 + brand.md
- AGENTS.md + README.md como entrada para devs/agentes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,53 @@
+# SAR — Variáveis de ambiente (template)
+# Copie para .env e ajuste para seu setup local
+# Em produção: Vault Agent injeta esses valores no entrypoint (CODING-RULES.md PGD-SEC-002)
+
+# Node environment
+NODE_ENV=development
+
+# API
+API_PORT=3000
+API_HOST=localhost
+
+# Web
+VITE_API_URL=http://localhost:3000/api/v1
+
+# Postgres (dev — para Prisma)
+DATABASE_URL=postgresql://sar:sar_dev_password@localhost:5432/sar_workspace_dev?schema=public
+MIGRATION_DATABASE_URL=postgresql://sar:sar_dev_password@localhost:5432/sar_workspace_dev?schema=public
+# Em prod: MIGRATION_DATABASE_URL aponta direto pro Postgres na porta 5432 (sem PgBouncer)
+# CODING-RULES.md PGD-DB-001
+
+# Master-login (DEV stub — substituir por IdP real na próxima sessão)
+MASTER_LOGIN_URL=http://localhost:3000/auth/dev
+MASTER_LOGIN_JWT_SECRET=dev_jwt_secret_change_in_prod_use_vault
+JWT_ACCESS_EXPIRATION=900  # 15 min
+JWT_REFRESH_EXPIRATION=2592000  # 30 dias
+
+# Valkey (Redis-compat)
+REDIS_URL=redis://localhost:6379
+
+# MinIO (S3-compat)
+S3_ENDPOINT=http://localhost:9000
+S3_REGION=us-east-1
+S3_ACCESS_KEY=sar_minio_admin
+S3_SECRET_KEY=sar_minio_dev_password
+S3_BUCKET=sar-dev
+
+# Email (DEV: Mailpit. Prod: Resend via Vault)
+SMTP_HOST=localhost
+SMTP_PORT=1025
+SMTP_FROM=noreply@sar.dev
+
+# Telemetry (DEV: opcional. Prod: Vault)
+OTEL_SERVICE_NAME=sar-api
+OTEL_TRACES_SAMPLER=parentbased_traceidratio
+OTEL_TRACES_SAMPLER_ARG=1.0
+SENTRY_DSN=
+
+# Feature flags (DEV: bypass. Prod: GrowthBook self-host)
+GROWTHBOOK_API_HOST=http://localhost:3100
+GROWTHBOOK_CLIENT_KEY=
+
+# Workspace context (DEV: workspace fixo de dev)
+DEFAULT_WORKSPACE_ID=dev-workspace