feat(api): scaffold Fastify server with health route

- ESM Fastify 4 with Pino logger (pretty-print in dev only)
- Plugins: helmet, cors (allowlist via CORS_ORIGINS), rate-limit, sensible
- Zod-validated environment config in src/config/env.ts
- Modular structure under src/modules with /health route
- tsx watch for dev, tsc for build, dist/server.js as production entry

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/app.ts

@@ -0,0 +1,40 @@
+import cors from '@fastify/cors';
+import helmet from '@fastify/helmet';
+import rateLimit from '@fastify/rate-limit';
+import sensible from '@fastify/sensible';
+import Fastify, { type FastifyInstance } from 'fastify';
+
+import { env } from './config/env.js';
+import { healthRoutes } from './modules/health/health.routes.js';
+
+export async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify({
+    logger: {
+      level: env.LOG_LEVEL,
+      ...(env.NODE_ENV === 'development'
+        ? {
+            transport: {
+              target: 'pino-pretty',
+              options: { translateTime: 'HH:MM:ss', ignore: 'pid,hostname' },
+            },
+          }
+        : {}),
+    },
+    disableRequestLogging: env.NODE_ENV === 'production',
+  });
+
+  await app.register(helmet, { global: true });
+  await app.register(cors, {
+    origin: env.CORS_ORIGINS,
+    credentials: true,
+  });
+  await app.register(rateLimit, {
+    max: 100,
+    timeWindow: '1 minute',
+  });
+  await app.register(sensible);
+
+  await app.register(healthRoutes);
+
+  return app;
+}