Phase 0: project scaffold

- Go module + chi server with embedded SPA serving and /api/health
- internal/config env loader (local-dev defaults; auth/copyleaks deferred)
- React 19 + Vite 6 + Tailwind v4 frontend with full Petal design tokens
- Frontend embedded into the binary via web/embed.go (go:embed all:dist)
- README dev workflow, .env.example, BUILD_PLAN progress tracker
- Verified end-to-end: binary serves health, embedded SPA, and SPA fallback

.env.example

@@ -0,0 +1,28 @@
+# Petal — copy to .env and fill in. All values have local-dev defaults; override as needed.
+
+# Server
+PORT=8080
+BASE_URL=http://localhost:8080
+
+# Database (SQLite, pure-Go modernc — no cgo)
+DATABASE_PATH=./data/petal.db
+
+# LLM
+LLM_BACKEND=vllm                  # vllm | ollama
+LLM_ENDPOINT=http://localhost:8000   # vLLM :8000, Ollama :11434
+LLM_MODEL=                        # checkpoint model (small/fast). Never hardcoded.
+LLM_CHAT_MODEL=                   # Ask Petal model (Mandarin-native). Falls back to LLM_MODEL if empty.
+LLM_TIMEOUT=30s
+
+# --- Deferred (not wired in the local-dev build) ---
+
+# Auth (Authentik OIDC) — deferred; single hardcoded local user for now
+# SESSION_SECRET=change-me-to-random-64-char-string
+# AUTHENTIK_URL=https://auth.parodia.dev
+# AUTHENTIK_CLIENT_ID=petal
+# AUTHENTIK_CLIENT_SECRET=
+
+# Copyleaks (Tier-2 plagiarism) — deferred; needs a public webhook
+# COPYLEAKS_ENABLED=false
+# COPYLEAKS_API_KEY=
+# COPYLEAKS_EMAIL=