feat: M0 monorepo skeleton with services, clients, deploy and CI

- api/openapi.yaml: contract with /healthz, /readyz, /api/v1/server-info
- services/api (Go): api with oapi-codegen strict server, goose migrations,
  readiness checks for Postgres/Redis; storage-agent stub with internal token
- services/recommender (Python, uv): FastAPI health/readiness/internal status,
  `pipu-rec serve` and `pipu-rec analyze` entrypoints
- packages: generated api-client, core (server URL + server check),
  i18n (ru/en + dictionary check), design-tokens (CSS vars + TS from tokens.json)
- apps/web: Vite + React shell showing server status, language switch
- apps/mobile: Expo (SDK 53) Android app with server connect screen
- deploy: Dockerfiles, compose (prod + dev), nginx template, install/update scripts
- .gitea/workflows: ci.yml and tag-based release.yml (images, signed APK, release)
- scripts/version.mjs: version and Android versionCode from git tag
- tests/fixtures/music/generate.sh: synthetic test library via ffmpeg
- docs: versionCode formula, OpenAPI 3.0.3, dev instructions in README

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/storageagent/router.go

@@ -0,0 +1,80 @@
+// Package storageagent — внутренний сервис монтирования хранилищ (см. docs/library-and-storage.md).
+// В M0 — каркас: проверка здоровья, аутентификация межсервисных запросов, список точек монтирования.
+package storageagent
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"pipu/api/internal/platform/httpx"
+)
+
+// Mount — состояние точки монтирования источника.
+type Mount struct {
+	SourceID string `json:"source_id"`
+	Path     string `json:"path"`
+}
+
+// NewRouter возвращает роутер агента. token — общий секрет INTERNAL_TOKEN.
+func NewRouter(token, libraryRoot string) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(httpx.NotFound)
+	r.Get("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+	})
+	r.Route("/internal", func(r chi.Router) {
+		r.Use(requireToken(token))
+		r.Get("/mounts", func(w http.ResponseWriter, _ *http.Request) {
+			mounts, err := listMounts(libraryRoot)
+			if err != nil {
+				httpx.WriteProblem(w, http.StatusInternalServerError, "storage.list_failed", err.Error())
+				return
+			}
+			writeJSON(w, http.StatusOK, map[string]any{"mounts": mounts})
+		})
+	})
+	return r
+}
+
+func requireToken(token string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			got, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
+			if !ok || subtle.ConstantTimeCompare([]byte(got), []byte(token)) != 1 {
+				httpx.WriteProblem(w, http.StatusUnauthorized, "auth.invalid_internal_token", "invalid internal token")
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// listMounts перечисляет подкаталоги корня библиотеки (каждый — точка монтирования источника).
+func listMounts(root string) ([]Mount, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return []Mount{}, nil
+		}
+		return nil, err
+	}
+	mounts := make([]Mount, 0, len(entries))
+	for _, e := range entries {
+		if e.IsDir() {
+			mounts = append(mounts, Mount{SourceID: e.Name(), Path: filepath.Join(root, e.Name())})
+		}
+	}
+	return mounts, nil
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(v)
+}

services/api/internal/storageagent/router_test.go

@@ -0,0 +1,49 @@
+package storageagent
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInternalRequiresToken(t *testing.T) {
+	h := NewRouter("secret", t.TempDir())
+
+	for _, auth := range []string{"", "Bearer wrong", "secret"} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/internal/mounts", nil)
+		if auth != "" {
+			req.Header.Set("Authorization", auth)
+		}
+		h.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusUnauthorized, rec.Code, "auth=%q", auth)
+	}
+}
+
+func TestListMounts(t *testing.T) {
+	root := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(root, "src-1"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(root, "stray.txt"), nil, 0o644))
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/internal/mounts", nil)
+	req.Header.Set("Authorization", "Bearer secret")
+	NewRouter("secret", root).ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	var body struct{ Mounts []Mount }
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body))
+	assert.Equal(t, []Mount{{SourceID: "src-1", Path: filepath.Join(root, "src-1")}}, body.Mounts)
+}
+
+func TestListMountsMissingRoot(t *testing.T) {
+	mounts, err := listMounts(filepath.Join(t.TempDir(), "absent"))
+	require.NoError(t, err)
+	assert.Empty(t, mounts)
+}