feat(core): 建立 fund-lab 可运行基线

[变更性质]
- 本提交冻结当前可构建、可测试的应用基线，不包含 PostgreSQL 持久化。

[新增功能]
- 建立 F# Domain、API、Worker、Web 及测试项目。
- 增加 Bearer 认证、健康检查、账本领域模型和中文空状态页面。

[实现方案]
- 使用环境变量模板注入认证配置，并排除数据、凭证和构建产物。
- 保留 19 个 Domain 测试和 5 个 API 测试作为后续变更基准。

[影响范围]
- 为后续 3a PostgreSQL FOF 创建/读取切片提供可回滚基线。
- 当前仍不接入真实基金数据、真实交易或数据库。

1 files changed, 39 insertions, 0 deletions

diff --git a/docs/overnight-progress.md b/docs/overnight-progress.md
new file mode 100644
index 0000000..1782d6d
--- /dev/null
+++ b/docs/overnight-progress.md
@@ -0,0 +1,39 @@
+# Overnight implementation evidence
+
+## 2026-09-20 22:27 CST supervisor check
+
+- The sole application writer is OpenCode session `ses_f41457d90ffeBoFot4SWxUSRm5`, actual assistant metadata `openai/gpt-5.6-luna`, variant `max`. Directory-scoped status remains busy; message count advanced from 245 at the preceding tick to 289 and then 294. No pending question was found. No duplicate writer or resume was started.
+- Worker tools show ledger/test corrections and subsequent documentation cleanup. Earlier compile failures and one residual-ownership test failure were followed by a passing worker test run. These historical failures are retained in OpenCode messages.
+- Hermes independently executed `dotnet build FundLab.sln --no-restore`: exit 0, zero warnings and errors. Then `dotnet test FundLab.sln --no-build --no-restore`: exit 0, domain 19/19 and API 5/5. This proves the current suites pass; it does not establish full accounting coverage or release completion. The source is not yet frozen in a commit.
+- Independently verified running gitweb mount `/home/somhairle/git` to `/git` and root write permission. Created only `/home/somhairle/git/fund-lab.git`; readback reports bare=true and HEAD=refs/heads/main. No other repository/service was changed.
+- Preliminary secret-pattern scan over 33 nonignored candidate files returned no matches. `.gitignore` excludes env secrets, credentials, data/cache/var, private keys, build outputs, node_modules and local tools. Repeat scan over exact final commit before publication. Working tree has no initial commit or remote; source push and public tree/hash checks remain pending.
+
+## Supervisor follow-up: environment blocker resolved
+
+- Worker became idle with a BLOCKED verdict claiming missing Node/npm and Git write discovery. Hermes re-read the handoff and independently reran both builds: .NET zero warnings/errors, Domain 19/19 and API 5/5, and Fable/Vite frontend production build passed using the project-local Node PATH. No environment installation is required.
+- Issued one scoped follow-up to the existing sole writer for milestone 3a: authenticated PostgreSQL-backed FOF create/read, exact money representation, transaction/idempotency and restart recovery tests. Required a reviewed-secret-exclusion baseline commit and a separately tested implementation commit. Git publication remains a separate independent gate.
+- API returned 204, exact user prompt was read back, scoped status became busy. Worker execution evidence is recorded in the dispatch state; no completion is claimed. Next milestone remains actual fund selection, simulated buy and visible holdings/NAV flow.
+
+## Next dependency and acceptance
+
+Wait for the active writer's terminal verdict, inspect the ledger fixes and added regression coverage, then freeze the accepted baseline and dispatch a small database-backed FOF vertical slice. Reuse the verified bare repository above; do not repeat service discovery. Prioritize fund creation, real instrument selection, simulated buy, persistence, holdings and NAV UI. Keep calendar/no-lookahead, numeric accounting, transactional idempotency, quote timestamps and authentication gates.
+
+## 2026-09-20 22:44 CST supervisor check
+
+- Directory-scoped status is busy. Main session messages increased from 316 to 325; no pending questions. Actual assistant metadata remains `openai/gpt-5.6-luna`, variant `max`. No resume or duplicate implementation session was dispatched.
+- A second busy session `ses_f40bc99f9ffe1mA4jUBLdfVofV` is the main writer's architecture-review child. Its explicit instruction is read-only; observed tools are reads/globs, not application writes. Its session metadata confirms the parent relationship. Some glob calls failed; the child has not yet returned a terminal verdict.
+- Newly completed worker commands show .NET build exit 0 with zero warnings/errors, Domain 19/19 and API 5/5 tests, and Fable/Vite build exit 0. These are worker execution evidence, not a fresh independent acceptance run.
+- Independent filesystem inspection still finds only the pre-existing API/test source files; no PostgreSQL slice is present yet. The bare target still has no `refs/heads/main`, so Git publication remains pending. Do not claim DB persistence or remote hosting from baseline builds.
+- Current dependency is the active read-only architecture review and main writer's baseline commit/3a implementation. Preserve the active writer; next tick inspect review completion, actual new source/tests and baseline commit before dispatching further work. Public UI, real quotes and restart/idempotency gates remain open.
+
+## 2026-09-20 22:52 CST supervisor check
+
+- Main writer remains busy at 325 messages, waiting for its read-only architecture child. Child has 28 messages and successful read tools through 22:52 CST, so the dependency is advancing; no pending question, duplicate writer or resume was introduced. Main assistant metadata remains openai/gpt-5.6-luna with max variant.
+- Independent filesystem read still shows the original four API F# files; no PostgreSQL implementation is present. Current wait is specifically the active architecture review, not a running database test. Inspect child verdict and main writer's first implementation artifact next tick.
+- Independent public probes of fund.somhairle.bid /health and /api/funds both failed TLS handshake with SSLEOFError. This records unavailable public acceptance from this host, without diagnosing DNS/tunnel cause or changing ingress. Deployment remains open.
+- https://git.somhairle.bid/fund-lab.git/ returned HTTP 200 and a cgit page naming fund-lab.git. This proves repository browser discovery only; commit/tree/hash publication is still unverified.
+- No fresh builds were run against the unchanged API slice, and no completion notice was created. No cron configuration was changed.
+
+## Open completion gates
+
+Real AKShare retrieval and dates; PostgreSQL integration/restart/idempotency; complete browser business flows and charts; authenticated public deployment; exact committed/remote/public Git hash; periodic investment/rebalancing and later direct stocks/bonds scope; quiet terminal notifier lifecycle. No completion notice exists and no release is claimed. Morning remains a progress checkpoint. This tick did not create or update cron jobs.