chore(scaffold): bootstrap docmost-sync Node/TS project skeleton

Set up the project structure per the new-project guide, adapted from the
Python skeleton to the Node/TS stack fixed in SPEC.md (reuses docmost-mcp).
Scaffold only — the sync engine is not implemented yet.

- src/settings.ts: single config layer on zod, schema keyed by real ENV
  names; credentials and own-service address have no default (fail fast).
- src/config-errors.ts: loadSettingsOrExit — clear startup message naming
  the missing/invalid env var instead of a raw stack trace; exit(1).
- src/index.ts: thin entry point that validates config and logs (stub).
- test/: vitest unit tests for settings parsing and config errors (10 tests).
- Makefile (install/env/build/test/run/dev/clean), strict tsconfig, vitest.
- Dockerfile (single-stage, no EXPOSE, prunes dev deps), docker-compose
  (daemon, volume on /app/data, watchtower), ghcr CI with build needs test.
- .env.example, .gitignore/.dockerignore, AGENTS.md, README.md.
- Pinned deps (dotenv, zod) + committed package-lock.json.

.env.example

@@ -0,0 +1,20 @@
+# Docmost connection (our own instance — no default in code)
+DOCMOST_API_URL=https://docmost.example.com
+
+# Docmost credentials for /auth/login (never commit real values)
+DOCMOST_EMAIL=you@example.com
+DOCMOST_PASSWORD=your_password_here
+
+# Which Docmost space to mirror
+DOCMOST_SPACE_ID=your_space_id_here
+
+# Local git vault (state store). Kept under data/ so the docker volume persists it.
+VAULT_PATH=data/vault
+
+# Optional git remote the vault pushes to (leave unset to stay local-only)
+# GIT_REMOTE=git@github.com:you/docmost-vault.git
+
+# Tunables (sensible defaults; override only if needed)
+POLL_INTERVAL_MS=15000
+DEBOUNCE_MS=2000
+LOG_LEVEL=info