[Step 4] Scaffold Fiber API + health/ready/metrics + middleware placeholders

[haydercyber]

Goal — REFACTOR_PLAN.md Step 4

Scaffold the Control Plane API: a Go + Fiber service with /healthz, /readyz, /metrics, structured logging, auth/RBAC/audit middleware placeholders, and a stable layout for handlers / services / repositories.

This is the first time the api repo gets code. It must compile, start, and answer probes — nothing else. Endpoint groups (projects, environments, agents, requests, approvals, audit, sync) come in later issues.

Scope

• go.mod: github.com/secrets-bridge/api, Go 1.24
• Fiber v3 app skeleton in cmd/api/main.go
• internal/handlers/ (HTTP layer; thin)
• internal/services/ (business logic; testable in isolation)
• pkg/storage/ placeholder (will hold Postgres in core#5)
• pkg/runtime/ placeholder (will hold Redis in core#6)
• pkg/workflow/ placeholder (will hold approval state machine in core#10)
• Endpoints: GET /healthz (200 always), GET /readyz (200 once DB+Redis stub returns ready), GET /metrics (Prometheus exposition)
• Middleware placeholders: requestID, structured logger, auth (stub), RBAC (stub), audit (stub, just emits "TODO: audit event with correlation_id=X")
• Versioned route group /api/v1
• CI workflow analogous to core/.github/workflows/ci.yml (build/test/lint/tidy)
• A short README.md describing the layout

Acceptance criteria

• docker run of the resulting image answers /healthz 200 and /metrics 200
• go test ./... green
• The handler tree is split by route group; no business logic in handlers

Hard rules (CLAUDE.md)

• API imports core/providers + core/sync only at this stage (no provider SDKs in API code)
• Stateless: no in-process state that wouldn't survive a pod restart
• Every privileged endpoint will eventually emit an audit event with a correlation ID — wire the middleware now even if it only logs

References

• BRD §13 FR-14, FR-17, NFR-08, §16.1, §23 (Technical Implementation Decisions)
• REFACTOR_PLAN §6 row 4

Dependencies

• core#1, core#2, core#3 — ✅ merged