Add the Hammerhead control plane

Dashboard and API, accounts (organizations, roles, invitations, 2FA, OIDC
single sign-on, API keys, revocable sessions), an encrypted SQLite database,
resource logins, alerts and /metrics, mail egress management with DKIM keys,
and the .env loader. Split out of the original single repository; depends on
Reef for the shared types. The end-to-end tests that run Hammerhead, Blacktip
and Bamboo together live in e2e/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,40 @@
+# Copy this file to .env and fill it in. .env is read by hammerhead, blacktip and
+# bamboo from their working directory (or pass -env /path/to/file). Real
+# environment variables always win over the file. NEVER commit .env.
+
+# ---------------------------------------------------------------- hammerhead
+
+# Encrypts secrets (tokens, SMTP/OIDC/relay passwords, DKIM private keys) inside the
+# database. Generate one with:  hammerhead -genkey
+# Keep it apart from the data folder and back it up: without it those secrets cannot
+# be read. If you leave it unset, a key is generated into <data>/master.key instead.
+HAMMERHEAD_MASTER_KEY=
+
+# Creates the first administrator at startup (otherwise use the setup page in the browser).
+#HAMMERHEAD_ADMIN_EMAIL=you@example.com
+#HAMMERHEAD_ADMIN_PASSWORD=
+
+# Public address people use to reach the dashboard (login redirects and SSO need it).
+#HAMMERHEAD_URL=https://hammerhead.example.com
+
+# Serves Prometheus metrics at /metrics for a scraper that sends this as a bearer token.
+# Leave empty and /metrics does not exist.
+#HAMMERHEAD_METRICS_TOKEN=
+
+# How long access logs are kept (days). Default 30.
+#HAMMERHEAD_LOG_DAYS=30
+
+# ------------------------------------------------------------------ blacktip
+# Token from Server -> Edges -> Show command.
+#BLACKTIP_HAMMERHEAD=https://hammerhead.example.com
+#BLACKTIP_TOKEN=
+
+# For wildcard certificates with Traefik (-traefik ... -acme-dns cloudflare): the
+# provider's credentials, named exactly as Traefik documents for that provider.
+#BLACKTIP_ACME_DNS=cloudflare
+#CF_DNS_API_TOKEN=
+
+# ------------------------------------------------------------------- bamboo
+# Token from Sites -> Show command.
+#BAMBOO_HAMMERHEAD=https://hammerhead.example.com
+#BAMBOO_TOKEN=