feat(core): 建立 fund-lab 可运行基线

[变更性质]
- 本提交冻结当前可构建、可测试的应用基线，不包含 PostgreSQL 持久化。

[新增功能]
- 建立 F# Domain、API、Worker、Web 及测试项目。
- 增加 Bearer 认证、健康检查、账本领域模型和中文空状态页面。

[实现方案]
- 使用环境变量模板注入认证配置，并排除数据、凭证和构建产物。
- 保留 19 个 Domain 测试和 5 个 API 测试作为后续变更基准。

[影响范围]
- 为后续 3a PostgreSQL FOF 创建/读取切片提供可回滚基线。
- 当前仍不接入真实基金数据、真实交易或数据库。

1 files changed, 19 insertions, 0 deletions

diff --git a/docs/leader-environment-unblock.md b/docs/leader-environment-unblock.md
new file mode 100644
index 0000000..d3ea84d
--- /dev/null
+++ b/docs/leader-environment-unblock.md
@@ -0,0 +1,19 @@
+# Hermes environment verification
+
+Verified independently on host, for next worker/supervisor step. Do not interrupt current ledger fix to repeat discovery.
+
+## Frontend
+
+Existing node executable: /home/somhairle/projects/fund-lab/.tools/node-v22.23.2/bin/node
+Actual output: v22.23.2
+With PATH=/home/somhairle/projects/fund-lab/.tools/node-v22.23.2/bin:$PATH, npm --version returns 10.9.8.
+Use this PATH for frontend builds. Node/npm absence in system PATH is not missing installation; do not reinstall or report frontend blocked for this reason.
+
+## Git service discovery
+
+Host /home/somhairle/gitweb/docker-compose.yml maps /home/somhairle/git to /git in gitweb container. cgitrc uses scan-path=/git. Existing bare-style repository directories: blog.git, living-village.git, sandbox.git, strategy-lab.git under /home/somhairle/git. Thus actual local serving root has been found. Do not continue guessing web creation APIs.
+Next authorized operational step: verify running mount/config, ownership/write permissions and an existing repo's bare status. Only after secret exclusions review, initialize independent fund-lab.git within confirmed root, establish exact local remote, push and compare commit hash with public cgit/remote readback. This needs precise external-directory access; if OpenCode access denied, stop and have Hermes perform authorized operational repository setup, not bypass permissions. Never modify existing repos or shared service configuration to add the new repository. Bare repository setup is now independently complete: /home/somhairle/git/fund-lab.git, verified bare=true and HEAD=refs/heads/main. Running gitweb mount was read back and maps /home/somhairle/git to /git read-write. The working tree still has no initial commit or remote; no source push or public code-tree verification has occurred. A preliminary scan of 33 nonignored candidate files found no private-key/token/password-pattern matches; repeat the scan on the exact final commit before publishing. Use this existing bare target, do not recreate it.
+
+## Work order
+
+Finish concrete ledger review regressions, freeze a tested commit, then move to database plus real fund data and visible end-to-end UI. Do not expand ledger abstractions beyond agreed requirements or repeatedly reload all design history. Keep non-overlapping operational discovery separate from the single application writer.