feat: initialize bangwen recruitment aggregation and search engine

- Rust core engine with HTTP ingestion gateway, hybrid search, and white-box resume matching
- Python edge collectors supporting declarative TOML and specialized adapters
- PostgreSQL schema migrations with pgvector embedding support
- Hardened security controls: strict CSP, terminal sanitization, and input boundary validation
- Multi-service container orchestration with dedicated non-root execution

Dockerfile

@@ -0,0 +1,32 @@
+FROM rust:1-bookworm AS builder
+WORKDIR /app
+
+RUN apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Check-Date=false update && apt-get install -y --no-install-recommends pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
+
+COPY Cargo.toml Cargo.lock ./
+COPY migrations ./migrations
+COPY src ./src
+
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo build --release && cp /app/target/release/bangwen /app/bangwen_bin
+
+FROM debian:bookworm-slim
+WORKDIR /app
+
+RUN apt-get -o Acquire::Check-Valid-Until=false -o Acquire::Check-Date=false update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd -g 10001 bangwen && useradd -u 10001 -g bangwen -s /bin/false bangwen
+
+COPY --from=builder /app/bangwen_bin /app/bangwen
+
+USER bangwen
+
+EXPOSE 8080
+ENV LOG_LEVEL=info
+ENV SERVER_HOST=0.0.0.0
+ENV SERVER_PORT=8080
+
+ENTRYPOINT ["/app/bangwen"]
+CMD ["serve", "--host", "0.0.0.0", "--port", "8080"]