Issue #2 - Add backend key service skeleton - Ticket 1

[knzeng-e]

Summary

Addresses #2 by adding the initial backend API skeleton for Dotify's production spine.

This PR introduces a dedicated services/api package that begins moving production-sensitive responsibilities out of the frontend and into a backend boundary.

What changed

• Add services/api TypeScript backend package.
• Add typed environment configuration.
• Add health/version-style routing foundation.
• Add auth nonce route foundation.
• Add content-key request route foundation.
• Add placeholder service modules for:
  • chain access checks;
  • key vault logic;
  • wallet signature handling.
• Add backend .env.example.
• Update README and frontend env example.
• Update .gitignore.

Production spine alignment

This is the first step toward:

• removing production secrets from the frontend;
• moving Pinata/key delivery behind a trusted service boundary;
• enabling wallet-signed content-key requests;
• supporting future production-grade access checks.

Review focus

Please review especially:

• environment validation and fail-fast behavior;
• route boundaries and naming;
• whether the service layout is clean enough before Tickets [Sprint 0][P0] Server-side Pinata uploads #3 and [Sprint 0][P0] Wallet-signed content-key requests for individual and host playback #4 build on top of it;
• whether README/env documentation is clear for a fresh contributor.

Follow-up tickets

• [Sprint 0][P0] Server-side Pinata uploads #3 Server-side Pinata uploads
• [Sprint 0][P0] Wallet-signed content-key requests for individual and host playback #4 Wallet-signed content-key requests

Notes

This PR should stay scoped to the backend skeleton. It should not implement the full upload pipeline or final content-key delivery yet.

[knzeng-e]

on second thought, we may need a way to "identify" the listeners. How can this be achieved without wallet/signature ?