feat(F-001): scaffold modular monolith skeleton with boundary checker

- TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app)
- scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures)
- GET /health endpoint, error envelope without stack leakage
- specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification
- 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md
- All gates approved: reviewer, security, qa; verify.sh green

specs/F-001-scaffold/TESTS.md

@@ -0,0 +1,25 @@
+# TESTS — F-001 Scaffold modular monolith skeleton
+
+## Unit / integration (Vitest)
+- `src/modules/health/tests/health.test.ts`: module-scoped; registers the module public API on a bare Fastify instance; `GET /health` → 200 and `{"status":"ok"}`.
+- `src/app/tests/build-app.test.ts`: composition root; health wired through `buildApp()`; unknown route → 404 JSON envelope without stack leak.
+- `scripts/tests/boundary-checker.test.ts`: run `check-module-boundaries.mjs` against fixture trees:
+  - fixture `ok` (imports inside own module + shared) → exit 0
+  - fixture `cross-module-internal` (imports another module's `domain/`) → exit 1
+  - fixture `deep-from-app` (app imports `modules/x/api/...` directly) → exit 1
+
+## Toolchain checks (manual/CI commands)
+- `npm run build` exits 0
+- `npm run typecheck` exits 0
+- `npm run lint` exits 0
+- `npm run lint:boundaries` exits 0 on clean tree
+- `npm test` exits 0
+
+## Acceptance traceability
+| Criterion | Evidence |
+|---|---|
+| install/build/lint/typecheck/test green | command outputs in implementer.md |
+| GET /health 200 ok | health.test.ts + build-app.test.ts |
+| src/{modules,shared,infrastructure,app} exist | tree listing in implementer.md |
+| boundary violation fails lint | boundary-checker.test.ts fixtures |
+| verify.sh green | qa.json evidence |