Implement Phase 1: core framework, operational tooling, and runbook

Core packages: crypto (Argon2id/AES-256-GCM), config (TOML/viper),
db (SQLite/migrations), barrier (encrypted storage), seal (state machine
with rate-limited unseal), auth (MCIAS integration with token cache),
policy (priority-based ACL engine), engine (interface + registry).

Server: HTTPS with TLS 1.2+, REST API, auth/admin middleware, htmx web UI
(init, unseal, login, dashboard pages).

CLI: cobra/viper subcommands (server, init, status, snapshot) with env
var override support (METACRYPT_ prefix).

Operational tooling: Dockerfile (multi-stage, non-root), docker-compose,
hardened systemd units (service + daily backup timer), install script,
backup script with retention pruning, production config examples.

Runbook covering installation, configuration, daily operations,
backup/restore, monitoring, troubleshooting, and security procedures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/dashboard.html

@@ -0,0 +1,31 @@
+{{define "title"}} - Dashboard{{end}}
+{{define "content"}}
+<h2>Dashboard</h2>
+<div class="status-bar">
+    <span>Logged in as <strong>{{.Username}}</strong></span>
+    {{if .IsAdmin}}<span class="badge">Admin</span>{{end}}
+    <span>State: <strong>{{.State}}</strong></span>
+    <a href="/login" onclick="fetch('/v1/auth/logout',{method:'POST'})">Logout</a>
+</div>
+
+<h3>Engine Mounts</h3>
+{{if .Mounts}}
+<table>
+    <thead><tr><th>Name</th><th>Type</th><th>Path</th></tr></thead>
+    <tbody>
+    {{range .Mounts}}
+    <tr><td>{{.Name}}</td><td>{{.Type}}</td><td>{{.MountPath}}</td></tr>
+    {{end}}
+    </tbody>
+</table>
+{{else}}
+<p>No engines mounted.</p>
+{{end}}
+
+{{if .IsAdmin}}
+<h3>Admin Actions</h3>
+<div class="admin-actions">
+    <button hx-post="/v1/seal" hx-confirm="Are you sure you want to seal the service?">Seal Service</button>
+</div>
+{{end}}
+{{end}}