Initialize repository with harness code and assets

Initial import of all source code, config, and README assets: the
packages workspace (cli, core, server, web, docs, landing, skills),
build scripts, tooling config, and CI workflows.

Includes the data-layout revision made on this branch: the local data
root defaults to ~/.penguin/data (PENGUIN_HOME still overrides; the
installer keeps its binaries in ~/.penguin), and every Agent lives
under <project>/agents/<agent>/ — path helpers, the three
agent-enumeration scans, the system prompt, built-in Skills, tests
and docs all follow the new layout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ihk8iQuo3kv2aPjAYEPuR

packages/server/src/http/routes/members.ts

@@ -0,0 +1,45 @@
+/**
+ * Member authorization routes:
+ * GET|POST /api/projects/:p/members, DELETE /api/projects/:p/members/:userId.
+ * Reading requires access; adding/removing is owner-only (validated inside the service).
+ */
+import { Hono } from "hono";
+import type { MemberAddResponse, MembersResponse } from "../../api/types.js";
+import type { AppEnv } from "../../auth/middleware.js";
+import { pathParam, readJson, requireString, requireValidId } from "../validate.js";
+import type { AppDeps } from "../../app.js";
+
+export function membersRoutes(deps: AppDeps): Hono<AppEnv> {
+  const app = new Hono<AppEnv>();
+
+  app.get("/", (c) => {
+    // Defensive id validation (FD-4).
+    const members = deps.projectService.listMembers(
+      c.var.user.userId,
+      requireValidId(c, "projectId"),
+    );
+    return c.json({ members } satisfies MembersResponse);
+  });
+
+  app.post("/", async (c) => {
+    const body = await readJson(c);
+    const userId = requireString(body, "userId", { label: "userId" });
+    const member = deps.projectService.addMember(
+      c.var.user.userId,
+      requireValidId(c, "projectId"),
+      userId,
+    );
+    return c.json({ member } satisfies MemberAddResponse, 201);
+  });
+
+  app.delete("/:userId", (c) => {
+    deps.projectService.removeMember(
+      c.var.user.userId,
+      requireValidId(c, "projectId"),
+      pathParam(c, "userId"),
+    );
+    return c.body(null, 204);
+  });
+
+  return app;
+}