Phase1 skeleton: replace demo main.py with src.server contract

- Overlay ModelHub XC Phase1 (health/status, STRATEGY_ID gate, dry-run)
- Dockerfile CMD -> python -m src.server; FROM stays platform TCR base
- Remove demo main.py and requirements.txt (stdlib only)
- Add tests/, scripts/, docs/, Makefile, config/examples (no secrets)

config/example.env

@@ -0,0 +1,20 @@
+# Copy to config/local.env (gitignored) for local runs. Never commit real tokens.
+
+# Required for process start (Phase1): non-empty STRATEGY_ID
+STRATEGY_ID=local-dev-strategy-placeholder
+
+# Optional listen port (default 8080)
+PORT=8080
+
+# Implementation is authoritative: ALLOW_LIVE_SUBMIT=1 AND
+# LIVE_CONFIRM=I_CONFIRM_LIVE_SUBMIT. No confirmation file is read.
+# PRD examples ALLOW_LIVE_SUBMIT=true / CONFIRM_LIVE=YES are unsupported.
+# Even with both set, no real client exists: still blocked. Keep defaults below.
+# Dual live gate — BOTH required for live; default is dry-run / blocked
+ALLOW_LIVE_SUBMIT=0
+LIVE_CONFIRM=
+
+# Platform injects EXTERNAL_SERVICE_TOKEN at runtime.
+# Community aliases (presence only; never log values):
+# XC_TOKEN_FILE / XC_TOKEN / MODELHUB_XC_TOKEN / EXTERNAL_SERVICE_TOKEN
+# EXTERNAL_SERVICE_TOKEN=