feat(F-001): scaffold modular monolith skeleton with boundary checker

- TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app)
- scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures)
- GET /health endpoint, error envelope without stack leakage
- specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification
- 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md
- All gates approved: reviewer, security, qa; verify.sh green

project/src/app/tests/build-app.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+import { buildApp } from '../build-app.js';
+
+describe('composition root', () => {
+  it('exposes GET /health through the wired app', async () => {
+    const app = await buildApp();
+    const response = await app.inject({ method: 'GET', url: '/health' });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toEqual({ status: 'ok' });
+    await app.close();
+  });
+
+  it('returns 404 JSON envelope for unknown routes without leaking internals', async () => {
+    const app = await buildApp();
+    const response = await app.inject({ method: 'GET', url: '/does-not-exist' });
+
+    expect(response.statusCode).toBe(404);
+    const body = response.json() as { error: { statusCode: number; message: string } };
+    expect(body.error.statusCode).toBe(404);
+    expect(body.error.message).toBe('Not Found');
+    expect(response.body).not.toContain('stack');
+    await app.close();
+  });
+});