Backend Phase A: foundation, migrations, Docker setup

- Go backend skeleton: config (caarlos0/env), slog JSON logging,
  pgxpool store, HTTP server with graceful shutdown.
- httpapi: render helpers, Problem errors, middleware chain
  (requestID / logging / recover / CORS), /healthz and /readyz.
- Migrations: full initial schema (users, sessions, lists,
  list_members, items, op_log SOURCE OF TRUTH, item_names) +
  golang-migrate runner binary using source/iofs (embedded).
- Docker: multi-stage Dockerfile (Go 1.26 -> distroless nonroot),
  builds both server and migrate binaries.
- deploy: docker-compose (caddy + backend + migrate + postgres:16),
  Caddyfile (auto-HTTPS), .env.example, pg extensions init script.
- AGENTS.md: project context + roadmap for AI agents.

Verified: image builds, both binaries run in container (smoke test).

deploy/.env.example

@@ -0,0 +1,44 @@
+# ===========================================================================
+# mitbringsl backend configuration
+# Copy this file to ".env" and adjust the values.
+#   cp .env.example .env
+# ===========================================================================
+
+# --- General app behavior ---
+APP_ENV=production                  # development | production
+LOG_LEVEL=info                      # debug | info | warn | error
+
+# The externally reachable base URL (scheme + host, no trailing slash).
+# Must match the domain you serve Caddy on. Used for OIDC redirect URIs etc.
+PUBLIC_BASE_URL=https://mitbringsl.example.com
+
+# The public domain Caddy serves. Used to set the Caddy site address.
+PUBLIC_DOMAIN=mitbringsl.example.com
+
+# --- PostgreSQL ---
+POSTGRES_USER=app
+# CHOOSE A STRONG PASSWORD (only required for first DB init, then stored).
+POSTGRES_PASSWORD=change-me-to-a-long-random-string
+POSTGRES_DB=appdb
+# DATABASE_URL is composed by docker-compose from the values above.
+
+# --- Session tokens ---
+# TTL of the opaque session token issued after login.
+SESSION_TOKEN_TTL=720h              # 30 days
+
+# --- OIDC: Google (optional) ---
+OIDC_GOOGLE_ENABLED=false
+# The OAuth client ID you created in Google Cloud Console (Audience the
+# backend accepts). No client_secret needed: the Android app performs the
+# code exchange itself and only sends the id_token to the backend.
+OIDC_GOOGLE_CLIENT_ID=
+OIDC_GOOGLE_ISSUER=https://accounts.google.com
+
+# --- OIDC: Generic provider (Keycloak, Authentik, Dex, ...; optional) ---
+OIDC_GENERIC_ENABLED=false
+OIDC_GENERIC_ISSUER=                # e.g. https://idp.example.com/realms/main
+OIDC_GENERIC_CLIENT_ID=             # audience the backend accepts
+
+# --- CORS (only relevant for browser clients; Android doesn't need it) ---
+# Comma-separated list of allowed origins, e.g. https://app.example.com
+CORS_ALLOWED_ORIGINS=