Runtime scaffold

The authenticated workspace is ready for its first domain slice.

This shell intentionally contains no authentication, patient records, live Firebase access, or business workflows.