chore: initialise Noema repository

Foundation for the persistent, inspectable cognitive runtime: README,
implementation plan with phases and risk register, architecture,
security model, threat model, contributing guide, eight ADRs covering
the global workspace, event immutability, memory representation, LLM
abstraction, capability system, authentication, frontend and storage.
Includes Makefile, env example, compose stack (pgvector) and Dockerfile
skeleton, plus a record of the development environment assumptions.

.env.example

@@ -0,0 +1,30 @@
+# Copy to .env and adjust. Never commit .env.
+# Precedence: defaults < config file (-config) < environment < database runtime settings.
+
+# --- core ---
+NOEMA_HTTP_ADDR=127.0.0.1:8080
+NOEMA_LOG_LEVEL=info            # debug|info|warn|error
+NOEMA_LOG_FORMAT=text           # text|json
+NOEMA_ENV=development           # development|production (production forces Secure cookies)
+
+# --- database (pgvector image in docker-compose provides the vector extension) ---
+NOEMA_DATABASE_URL=postgres://noema:noema@127.0.0.1:5433/noema?sslmode=disable
+
+# --- secrets ---
+# 32 bytes, base64. Encrypts provider API keys at rest. Generate: openssl rand -base64 32
+NOEMA_MASTER_KEY=
+# Optional first-run administrator. Only used when the users table is empty.
+NOEMA_BOOTSTRAP_ADMIN_USER=admin
+NOEMA_BOOTSTRAP_ADMIN_PASSWORD=
+
+# --- LLM provider secrets, referenced from the UI as env:NAME ---
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+
+# --- research folder (watched for ingestion) ---
+NOEMA_RESEARCH_DIR=./research
+
+# --- resource governance (per daemon) ---
+NOEMA_MAX_WORKERS=8
+NOEMA_MAX_CONCURRENT_LLM=4
+NOEMA_DAILY_TOKEN_BUDGET=2000000