Implement Phase 1: core framework, operational tooling, and runbook

Core packages: crypto (Argon2id/AES-256-GCM), config (TOML/viper),
db (SQLite/migrations), barrier (encrypted storage), seal (state machine
with rate-limited unseal), auth (MCIAS integration with token cache),
policy (priority-based ACL engine), engine (interface + registry).

Server: HTTPS with TLS 1.2+, REST API, auth/admin middleware, htmx web UI
(init, unseal, login, dashboard pages).

CLI: cobra/viper subcommands (server, init, status, snapshot) with env
var override support (METACRYPT_ prefix).

Operational tooling: Dockerfile (multi-stage, non-root), docker-compose,
hardened systemd units (service + daily backup timer), install script,
backup script with retention pruning, production config examples.

Runbook covering installation, configuration, daily operations,
backup/restore, monitoring, troubleshooting, and security procedures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config_test.go

@@ -0,0 +1,64 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadValid(t *testing.T) {
+	content := `
+[server]
+listen_addr = ":8443"
+tls_cert = "cert.pem"
+tls_key = "key.pem"
+
+[database]
+path = "test.db"
+
+[mcias]
+server_url = "https://mcias.example.com"
+`
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.toml")
+	os.WriteFile(path, []byte(content), 0600)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Server.ListenAddr != ":8443" {
+		t.Errorf("ListenAddr: got %q", cfg.Server.ListenAddr)
+	}
+	if cfg.Seal.Argon2Time != 3 {
+		t.Errorf("Argon2Time default: got %d, want 3", cfg.Seal.Argon2Time)
+	}
+	if cfg.Seal.Argon2Memory != 128*1024 {
+		t.Errorf("Argon2Memory default: got %d", cfg.Seal.Argon2Memory)
+	}
+	if cfg.Log.Level != "info" {
+		t.Errorf("Log.Level default: got %q", cfg.Log.Level)
+	}
+}
+
+func TestLoadMissingRequired(t *testing.T) {
+	content := `
+[server]
+listen_addr = ":8443"
+`
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.toml")
+	os.WriteFile(path, []byte(content), 0600)
+
+	_, err := Load(path)
+	if err == nil {
+		t.Fatal("expected error for missing required fields")
+	}
+}
+
+func TestLoadMissingFile(t *testing.T) {
+	_, err := Load("/nonexistent/path.toml")
+	if err == nil {
+		t.Fatal("expected error for missing file")
+	}
+}