feat: initial alpha scaffold — FastAPI + MCP + pgvector

Implements v0.0.1 of OpenBrain:

- FastAPI REST API (capture, search, recent, stats) with Bearer auth
- MCP server (streamable HTTP at /mcp) exposing all 4 tools
- pgvector schema (vector(1024) for bge-m3)
- asyncpg connection pool with lazy init + graceful close
- Ollama embedding client with fallback (stores thought without vector if Ollama unreachable)
- Woodpecker CI pipeline (lint + kaniko build + push to Gitea registry)
- Portainer/Swarm deployment compose
- Mosaic framework files: AGENTS.md, PRD.md, TASKS.md, scratchpad

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.portainer.yml

@@ -0,0 +1,65 @@
+# OpenBrain — Portainer / Docker Swarm deployment
+#
+# Required environment variables (set in Portainer stack env):
+#   POSTGRES_PASSWORD   — postgres user password
+#   API_KEY             — secret key for API/MCP auth
+#   OLLAMA_URL          — Ollama endpoint (e.g. http://10.x.x.x:11434)
+#   IMAGE_TAG           — image tag to deploy (e.g. sha-abc1234 or 0.0.1)
+#
+# Optional:
+#   OLLAMA_EMBEDDING_MODEL  — default: bge-m3:latest
+#   LOG_LEVEL               — default: info
+
+services:
+  brain-db:
+    image: pgvector/pgvector:pg17
+    environment:
+      POSTGRES_USER: openbrain
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: openbrain
+    volumes:
+      - brain_db_data:/var/lib/postgresql/data
+      - /opt/openbrain/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U openbrain -d openbrain"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - brain-internal
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+
+  brain-api:
+    image: git.mosaicstack.dev/mosaic/openbrain:${IMAGE_TAG:-latest}
+    environment:
+      DATABASE_URL: postgresql://openbrain:${POSTGRES_PASSWORD}@brain-db:5432/openbrain
+      API_KEY: ${API_KEY}
+      OLLAMA_URL: ${OLLAMA_URL}
+      OLLAMA_EMBEDDING_MODEL: ${OLLAMA_EMBEDDING_MODEL:-bge-m3:latest}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+    ports:
+      - "8765:8000"
+    depends_on:
+      - brain-db
+    networks:
+      - brain-internal
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.routers.openbrain.rule=Host(`brain.woltje.com`)"
+        - "traefik.http.routers.openbrain.entrypoints=websecure"
+        - "traefik.http.routers.openbrain.tls=true"
+        - "traefik.http.services.openbrain.loadbalancer.server.port=8000"
+
+volumes:
+  brain_db_data:
+
+networks:
+  brain-internal:
+    driver: overlay