Implement Phase 1: core framework, operational tooling, and runbook

Core packages: crypto (Argon2id/AES-256-GCM), config (TOML/viper),
db (SQLite/migrations), barrier (encrypted storage), seal (state machine
with rate-limited unseal), auth (MCIAS integration with token cache),
policy (priority-based ACL engine), engine (interface + registry).

Server: HTTPS with TLS 1.2+, REST API, auth/admin middleware, htmx web UI
(init, unseal, login, dashboard pages).

CLI: cobra/viper subcommands (server, init, status, snapshot) with env
var override support (METACRYPT_ prefix).

Operational tooling: Dockerfile (multi-stage, non-root), docker-compose,
hardened systemd units (service + daily backup timer), install script,
backup script with retention pruning, production config examples.

Runbook covering installation, configuration, daily operations,
backup/restore, monitoring, troubleshooting, and security procedures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

proto/metacrypt/v1/auth.proto

@@ -0,0 +1,32 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
+
+service AuthService {
+  rpc Login(LoginRequest) returns (LoginResponse);
+  rpc Logout(LogoutRequest) returns (LogoutResponse);
+  rpc TokenInfo(TokenInfoRequest) returns (TokenInfoResponse);
+}
+
+message LoginRequest {
+  string username = 1;
+  string password = 2;
+  string totp_code = 3;
+}
+
+message LoginResponse {
+  string token = 1;
+  string expires_at = 2;
+}
+
+message LogoutRequest {}
+message LogoutResponse {}
+
+message TokenInfoRequest {}
+message TokenInfoResponse {
+  string username = 1;
+  repeated string roles = 2;
+  bool is_admin = 3;
+}

proto/metacrypt/v1/common.proto

@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";

proto/metacrypt/v1/engine.proto

@@ -0,0 +1,47 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+import "google/protobuf/struct.proto";
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
+
+service EngineService {
+  rpc Mount(MountRequest) returns (MountResponse);
+  rpc Unmount(UnmountRequest) returns (UnmountResponse);
+  rpc ListMounts(ListMountsRequest) returns (ListMountsResponse);
+  rpc Request(EngineRequest) returns (EngineResponse);
+}
+
+message MountRequest {
+  string name = 1;
+  string type = 2;
+}
+message MountResponse {}
+
+message UnmountRequest {
+  string name = 1;
+}
+message UnmountResponse {}
+
+message ListMountsRequest {}
+message ListMountsResponse {
+  repeated MountInfo mounts = 1;
+}
+
+message MountInfo {
+  string name = 1;
+  string type = 2;
+  string mount_path = 3;
+}
+
+message EngineRequest {
+  string mount = 1;
+  string operation = 2;
+  string path = 3;
+  google.protobuf.Struct data = 4;
+}
+
+message EngineResponse {
+  google.protobuf.Struct data = 1;
+}

proto/metacrypt/v1/policy.proto

@@ -0,0 +1,41 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
+
+service PolicyService {
+  rpc CreatePolicy(CreatePolicyRequest) returns (PolicyRule);
+  rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse);
+  rpc GetPolicy(GetPolicyRequest) returns (PolicyRule);
+  rpc DeletePolicy(DeletePolicyRequest) returns (DeletePolicyResponse);
+}
+
+message PolicyRule {
+  string id = 1;
+  int32 priority = 2;
+  string effect = 3;
+  repeated string usernames = 4;
+  repeated string roles = 5;
+  repeated string resources = 6;
+  repeated string actions = 7;
+}
+
+message CreatePolicyRequest {
+  PolicyRule rule = 1;
+}
+
+message ListPoliciesRequest {}
+message ListPoliciesResponse {
+  repeated PolicyRule rules = 1;
+}
+
+message GetPolicyRequest {
+  string id = 1;
+}
+
+message DeletePolicyRequest {
+  string id = 1;
+}
+
+message DeletePolicyResponse {}

proto/metacrypt/v1/system.proto

@@ -0,0 +1,36 @@
+syntax = "proto3";
+
+package metacrypt.v1;
+
+option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
+
+service SystemService {
+  rpc Status(StatusRequest) returns (StatusResponse);
+  rpc Init(InitRequest) returns (InitResponse);
+  rpc Unseal(UnsealRequest) returns (UnsealResponse);
+  rpc Seal(SealRequest) returns (SealResponse);
+}
+
+message StatusRequest {}
+message StatusResponse {
+  string state = 1;
+}
+
+message InitRequest {
+  string password = 1;
+}
+message InitResponse {
+  string state = 1;
+}
+
+message UnsealRequest {
+  string password = 1;
+}
+message UnsealResponse {
+  string state = 1;
+}
+
+message SealRequest {}
+message SealResponse {
+  string state = 1;
+}