feat(m0): 后端骨架 + Web/安卓前端骨架 + 设计文档

- backend: FastAPI 应用工厂、统一错误信封、JWT、短信登录、工作区/成员/邀请、幂等中间件
- alembic 0001: workspace/member/invitation/audit_log/app_user + RLS 策略 + 双角色 GRANT
- tests: 认证/工作区/租户隔离/幂等 四组用例（尚未在本机执行）
- web: React18+Vite 骨架（登录、工作区、邀请落地页）
- android: Compose 骨架（登录、工作区列表）
- 2.Design: PRODUCT-PLAN / ROADMAP-M0-M1 / NAMING / DEVELOPMENT

deploy/docker-compose.dev.yml

@@ -0,0 +1,37 @@
+# 本地开发依赖。端口避开默认值（5433/6380），避免和机器上已有实例打架。
+name: dadaotask-dev
+
+services:
+  postgres:
+    image: pgvector/pgvector:pg16
+    container_name: dadaotask-pg
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres_dev_pw
+      POSTGRES_DB: dadaotask
+    ports:
+      - "127.0.0.1:5433:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      # 首次初始化时创建 dadao_owner / dadao_app 两个角色
+      - ./postgres/init:/docker-entrypoint-initdb.d:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d dadaotask"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  redis:
+    image: redis:7-alpine
+    container_name: dadaotask-redis
+    ports:
+      - "127.0.0.1:6380:6379"
+    command: ["redis-server", "--appendonly", "yes"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+volumes:
+  pgdata:

deploy/postgres/init/01-roles.sql

@@ -0,0 +1,14 @@
+-- 首次初始化脚本（postgres 容器 entrypoint 执行）。
+-- 关键点：应用角色 dadao_app **不是** owner、不是 superuser、没有 BYPASSRLS。
+-- 否则 PostgreSQL 会直接跳过行级安全，多租户隔离形同虚设。
+
+CREATE ROLE dadao_owner LOGIN PASSWORD 'dadao_dev_pw';
+CREATE ROLE dadao_app LOGIN PASSWORD 'dadao_dev_pw';
+
+-- 迁移角色拥有数据库（可以建表），应用角色只能读写数据
+ALTER DATABASE dadaotask OWNER TO dadao_owner;
+
+GRANT CONNECT ON DATABASE dadaotask TO dadao_app;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+ALTER SCHEMA public OWNER TO dadao_owner;
+GRANT USAGE ON SCHEMA public TO dadao_app;