Implement Phase 1 tasks 1.1-1.4 (scaffold + core types + config + Postgres)

Scaffold mirrors tcp-ingestion conventions: ESM, strict TS, pnpm, vitest
with unit/integration split, ESLint flat config with no-floating-promises
+ no-misused-promises + import/no-restricted-paths (the new src/core/ →
src/domain/ boundary that protects Phase 1 from Phase 2 churn).

Core types in src/core/types.ts (Position, StreamRecord, DeviceState,
Metrics, AttributeValue) — Position is byte-equivalent to tcp-ingestion's
output. Codec in src/core/codec.ts implements sentinel reversal:
{__bigint:"..."} → bigint, {__buffer_b64:"..."} → Buffer, ISO timestamp
string → Date. CodecError surfaces malformed payload reasons with the
failing field named.

Config in src/config/load.ts (zod schema, all 13 env vars with defaults
and bounded numerics). Logger in src/observability/logger.ts matches
tcp-ingestion exactly: ISO timestamps, string level labels, pino-pretty
in development.

Postgres in src/db/: createPool with sane defaults and application_name,
connectWithRetry mirroring the ioredis retry pattern, a 30-line
migration runner using a schema_migrations table, and 0001_positions.sql
with the hypertable + (device_id, ts) unique index + ts DESC index.
Migration runner unit-tested against a mocked pg.Pool; the real
TimescaleDB round-trip is deferred to task 1.10 per spec.

Verification: typecheck, lint, build all clean; 73 unit tests passing
across 4 files. import/no-restricted-paths verified live by temporarily
adding a forbidden src/domain/ import.

src/main.ts

@@ -0,0 +1,28 @@
+import { loadConfig } from './config/load.js';
+import type { Config } from './config/load.js';
+import { createLogger } from './observability/logger.js';
+
+// -------------------------------------------------------------------------
+// Startup: validate config (fail fast on bad env), build logger
+// -------------------------------------------------------------------------
+
+let config: Config;
+try {
+  config = loadConfig();
+} catch (err) {
+  // Config validation failures print a human-readable message and exit 1.
+  // Logger is not available yet — process.stderr is the only output channel.
+  process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+  process.exit(1);
+}
+
+const logger = createLogger({
+  level: config.LOG_LEVEL,
+  nodeEnv: config.NODE_ENV,
+  instanceId: config.INSTANCE_ID,
+});
+
+logger.info('processor starting');
+
+// Consumer, writer, and state wiring land in tasks 1.5–1.8.
+process.exit(0);