feat(F-001): scaffold modular monolith skeleton with boundary checker

- TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app)
- scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures)
- GET /health endpoint, error envelope without stack leakage
- specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification
- 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md
- All gates approved: reviewer, security, qa; verify.sh green

work/artifacts/F-001/security.json

@@ -0,0 +1,27 @@
+{
+  "feature_id": "F-001",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "Security gate passed. Zero audit vulnerabilities, no hardcoded secrets, no dangerous patterns in src/, error envelope prevents stack leakage, new dependencies justified in spec/tech.md per policy.",
+  "checks": {
+    "secrets": "PASS: grep for api_key/secret/password/token patterns in project code found none",
+    "dependencies": "PASS: npm audit --omit=dev -> 0 vulnerabilities; npm audit (full) -> 0 vulnerabilities; dependency table with justification added to spec/tech.md",
+    "sast_basic": "PASS: no eval, no new Function, no child_process in src/ (execFile used only in test harness with fixed, non-user-controlled arguments)",
+    "input_validation": "PASS (n/a scope): no user input surfaces yet beyond GET /health; Fastify default JSON body limits apply; error handler returns generic message for 5xx",
+    "repo_hygiene": "PASS: project/.gitignore excludes node_modules, dist, coverage, logs"
+  },
+  "findings": [
+    {
+      "severity": "info",
+      "note": "No auth, rate limiting or CSRF surface exists yet; tracked in F-005/F-028. Nothing to mitigate in F-001."
+    }
+  ],
+  "evidence": [
+    "npm audit --omit=dev -> found 0 vulnerabilities",
+    "npm audit -> found 0 vulnerabilities",
+    "grep secret scan over project/src, project/scripts, configs -> no hardcoded secrets",
+    "grep eval|new Function|child_process over project/src -> none",
+    "dependency justification added to spec/tech.md (fastify, typescript, vitest, eslint stack, prettier)"
+  ],
+  "timestamp": "2026-08-14T19:48:00Z"
+}