chore: bootstrap repo tooling, dependency and quality gates

uv-managed PEP 621 project with ruff, mypy (strict on packages/domain and
packages/llm), pytest with coverage, and import-linter contracts that
mechanically enforce the dependency rules of 架构文档 §4.2 -- including the
two forbidden edges (compliance and identity must not depend on business
domains). CI, pre-commit and a detect-secrets baseline gate every push;
.env is gitignored before anything is ever staged.

.gitignore

@@ -0,0 +1,41 @@
+# --- SECRETS: never commit. The real DeepSeek key lives in .env only. ---
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+secrets/
+
+# Python
+__pycache__/
+*.py[cod]
+*.so
+.Python
+build/
+dist/
+*.egg-info/
+.venv/
+venv/
+
+# Tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+.importlinter_cache/
+
+# Local runtime artefacts
+*.log
+.pgdata/
+.redisdata/
+.scratch/
+.smoke/
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db