chore: scaffold PYRE MVP monorepo (structure + docs)

pnpm + TypeScript workspace per design doc §13:
- apps/{web,api,worker} skeletons (Next.js 16, Fastify 5, BullMQ)
- packages/{core,solana,prometheus,db,config} (core has real types/DTOs;
  solana/prometheus are stubs)
- programs/pyre-core placeholder (future Anchor, v1.0)
- docs/: PYRE_MVP_DESIGN (canonical), ARCHITECTURE, SECURITY, TOKEN_CLASSIFICATION
- CLAUDE.md, README, .env.example (no private-key var by design)

Skeleton + docs only — no Solana/business logic yet. All workspaces typecheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,49 @@
+# ============================================================================
+# PYRE / Prometheus Protocol — environment template
+# Copy to .env (per app) and fill in. NEVER commit a real .env.
+#
+# CORE TRUST RULE: PYRE never holds private keys. There is intentionally NO
+# wallet private key / mnemonic variable anywhere in this file. All signing
+# happens client-side in the user's wallet.
+# ============================================================================
+
+# ---- Solana ----------------------------------------------------------------
+# Use an external RPC provider (Helius, Triton, QuickNode, etc.).
+# Do NOT run a validator/RPC node on the MVP VPS.
+SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
+SOLANA_RPC_WS_URL=
+SOLANA_CLUSTER=mainnet-beta            # mainnet-beta | devnet | testnet
+
+# ---- Database (PostgreSQL) -------------------------------------------------
+DATABASE_URL=postgresql://pyre:pyre@localhost:5432/pyre
+
+# ---- Redis (queues, cache, rate limiting) ----------------------------------
+REDIS_URL=redis://localhost:6379
+
+# ---- AI services (Prometheus) ----------------------------------------------
+# API-based only for MVP. Do NOT run local LLMs/image models on the server.
+ANTHROPIC_API_KEY=
+OPENAI_API_KEY=
+IMAGE_GEN_PROVIDER=                    # e.g. openai | stability | replicate
+IMAGE_GEN_API_KEY=
+
+# ---- App URLs / ports ------------------------------------------------------
+WEB_PORT=3000
+API_PORT=4000
+WEB_PUBLIC_URL=http://localhost:3000
+API_PUBLIC_URL=http://localhost:4000
+
+# ---- Admin / security ------------------------------------------------------
+ADMIN_API_TOKEN=                       # protects /admin endpoints
+RATE_LIMIT_SCAN_PER_MIN=10
+
+# ---- Classification safety thresholds --------------------------------------
+PROTECTED_USD_THRESHOLD=50             # skip tokens valued above this (USD)
+MAX_PRICE_IMPACT_BPS=300               # skip swap routes above this impact
+QUOTE_MAX_AGE_MS=15000                 # skip stale quotes older than this
+
+# ---- Optional: metadata / launch (later phases) ----------------------------
+IPFS_OR_ARWEAVE_ENDPOINT=
+IPFS_OR_ARWEAVE_TOKEN=
+# Public key only — the operator signs Pump.fun launches manually in MVP.
+PUMPFUN_CREATOR_WALLET_PUBKEY=