feat(M1): Project scaffolding, DB schema, core infrastructure

- Initialize Rust workspace with 7 crates (pm-web, pm-worker, pm-core,
  pm-agent-client, pm-auth, pm-ca, pm-reports)
- React + TypeScript + Vite + MUI frontend scaffold
- Full PostgreSQL schema: all 17 tables with indexes and constraints
- pm-core: config (TOML+env), db (SQLx pool + migrations), error
  (unified AppError + JSON envelope), request_id (ULID middleware),
  logging (tracing JSON/pretty)
- pm-web: Axum skeleton, /status/health endpoint, static file serving
- pm-worker: Tokio skeleton, heartbeat writer, schema version check
- Embedded sqlx migrations with advisory lock (single-writer)
- systemd unit files, setup.sh, build-frontend.sh
- config.example.toml with all configuration keys
- docs/runbooks/restore.md
- cargo check passes with zero warnings

Closes M1.

SPEC.md

@@ -174,9 +174,7 @@ Management plane web application communicating with Linux Patch API agents on ea
 - Patch Manager host has network connectivity to all managed agents
 - Linux Patch API agent is installed and running on each managed host
 - Server administrators manually distribute mTLS and root certificates to managed clients
-- PostgreSQL is available on the Patch Manager host
-- Server administrators manually distribute mTLS and root certificates to managed clients
-- PostgreSQL is available on the Patch Manager host
+- PostgreSQL 16+ is available on the Patch Manager host
 - Hardware host provides full-disk encryption (no OS-level disk encryption managed by the application)
 
 ## Dependencies