Backend Phase A: foundation, migrations, Docker setup

- Go backend skeleton: config (caarlos0/env), slog JSON logging,
  pgxpool store, HTTP server with graceful shutdown.
- httpapi: render helpers, Problem errors, middleware chain
  (requestID / logging / recover / CORS), /healthz and /readyz.
- Migrations: full initial schema (users, sessions, lists,
  list_members, items, op_log SOURCE OF TRUTH, item_names) +
  golang-migrate runner binary using source/iofs (embedded).
- Docker: multi-stage Dockerfile (Go 1.26 -> distroless nonroot),
  builds both server and migrate binaries.
- deploy: docker-compose (caddy + backend + migrate + postgres:16),
  Caddyfile (auto-HTTPS), .env.example, pg extensions init script.
- AGENTS.md: project context + roadmap for AI agents.

Verified: image builds, both binaries run in container (smoke test).

backend/internal/httpapi/api.go

@@ -0,0 +1,56 @@
+package httpapi
+
+import (
+	"net/http"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/mitbringsl/backend/internal/config"
+)
+
+// API bundles all handler groups and wires the router.
+// Handler groups are added in subsequent phases (auth, lists, items, suggestions).
+type API struct {
+	cfg  *config.Config
+	pool *pgxpool.Pool
+
+	health *HealthHandler
+}
+
+// NewAPI constructs the API with all handler groups.
+func NewAPI(cfg *config.Config, pool *pgxpool.Pool) *API {
+	return &API{
+		cfg:    cfg,
+		pool:   pool,
+		health: &HealthHandler{Pool: pool},
+	}
+}
+
+// Handler returns the fully wired http.Handler with all middleware applied.
+func (a *API) Handler() http.Handler {
+	mux := http.NewServeMux()
+
+	// --- public health endpoints (no auth) ---
+	mux.HandleFunc("GET /healthz", a.health.Healthz)
+	mux.HandleFunc("GET /readyz", a.health.Readyz)
+
+	// --- auth endpoints (added in Phase B) ---
+	// mux.HandleFunc("POST /auth/register", a.auth.Register)
+	// mux.HandleFunc("POST /auth/login", a.auth.Login)
+	// mux.HandleFunc("POST /auth/oidc", a.auth.OIDC)
+	// mux.HandleFunc("POST /auth/logout", a.auth.Logout)
+
+	// --- authenticated API endpoints (added in Phase C) ---
+	// mux.HandleFunc("GET /api/lists", a.requireAuth(a.lists.List))
+	// mux.HandleFunc("GET /api/lists/{id}/ops", a.requireAuth(a.items.PullOps))
+	// mux.HandleFunc("POST /api/lists/{id}/ops", a.requireAuth(a.items.PushOps))
+	// mux.HandleFunc("GET /api/suggestions", a.requireAuth(a.suggest.Suggest))
+
+	return Chain(
+		mux,
+		requestIDMiddleware,
+		loggingMiddleware,
+		recoverMiddleware,
+		corsMiddleware(a.cfg),
+	)
+}