feat: establish portable platform foundations

[BeforeLights]

What changed

This PR delivers Engineering Foundation Tasks 1–11 for the clean DataBreeze platform monorepo:

• pinned Node/pnpm, Python/uv, JDK, PostgreSQL, and Redis release lines
• Turborepo workspace rules and enforced dependency boundaries
• machine-readable traceability for all 611 requirements (444 P0)
• versioned OpenAPI/JSON Schema envelopes and generated TypeScript, Kotlin, and Python models
• cross-runtime contract parity fixtures
• scoped authorization primitives and six initial roles
• portable configuration and replaceable provider ports
• complete Vietnamese-first and English localization foundation
• immutable legacy DataBreeze logo sources with checksum protection
• deterministic Web, Windows Desktop, and Android brand derivative pipeline

Why

Every later Web, Desktop, Android, API, worker, sync, and product-module slice depends on stable contracts, tenant-safe boundaries, provider portability, complete terminology, and reproducible brand assets. This PR establishes those foundations before deployable shells or customer workflows are added.

User/developer impact

• Developers can build and test the shared foundation from a clean checkout.
• Contract drift and cross-language disagreement fail CI.
• Vendor integrations remain replaceable rather than embedded in product logic.
• The approved legacy DataBreeze identity is preserved byte-for-byte and generates governed platform assets.
• No Shopee, TikTok, or other restricted marketplace API is introduced.

Validation

• corepack pnpm repo:check
• corepack pnpm repo:build
• 45 design/brand tests, including clean regeneration and filesystem mutation probes
• 28 contract parity fixtures across TypeScript, Python, and Kotlin
• detached clean-worktree frozen install/regeneration checks
• independent implementer/reviewer loops for each completed task
• PR-wide git diff --check dev..HEAD

Scope note

This is the first foundation PR. Design tokens/UI primitives and deployable Web/Desktop/Android/API/worker shells remain for subsequent short-lived feature branches.

Summary by CodeRabbit

• New Features

  • Added versioned foundations for runtime configuration, authorization, permissions, tenant scopes, provider integrations, and shared data contracts.
  • Added Vietnamese-first and English localization with locale negotiation, message interpolation, and formatting for dates, numbers, currencies, and relative times.
  • Added reproducible brand assets for Android, desktop, and web platforms.
  • Added cross-runtime contract validation across TypeScript, Python, and Kotlin.

• Documentation

  • Added platform, engineering, package, compatibility, and requirement-traceability documentation.

• Chores

  • Standardized repository tooling, formatting, runtime versions, and workspace validation.

[BeforeLights]

CodeRabbit review disposition (single review for this PR):

• Valid findings were reproduced, fixed in atomic commits, and revalidated across repository check/build.
• The suggested COMPATIBILITY.md rename was rejected: the root script is contracts:check, so the existing documented command is correct.
• The suggested pnpm 11.19.0 pin was adjusted to stable 11.18.0 because 11.19.0 is currently on the next-11 channel; 11.18.0 includes the cited security fix.
• Integrated validation: 20 repo-policy tests, 46 contract tests, 48 brand tests, 28 cross-runtime fixtures, 10/10 test tasks, 6/6 build tasks.
• No second CodeRabbit review was invoked.