feat(V1-API): implement TREX-Basic consumer API contract with encryption and persistence

- Add V1 API endpoints: assets, ledger, user-info
- Implement Fernet-based credential payload encryption (req-010)
- Extend health response schema with runtime info (req-004)
- Add service token runtime ID issuance (req-005)
- Implement database schema migration for V1 API (req-009)
- Add comprehensive test coverage for V1 endpoints
- Update SRS with 10 new requirements (REQ-004 through REQ-011)
- Create batch planning, design, and verification for BAT-001
- Integrate review-discovery StagePilot skill
- Update documentation indices and baseline specs

app/api/v1_user_info.py

@@ -0,0 +1,53 @@
+"""GET /v1/user_info — service-token authenticated user info endpoint."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from app.core.auth import AuthContext, require_read
+from app.repositories.factory import get_portfolio_repository_from_settings
+from app.schemas.v1 import UserInfoResponse
+
+router = APIRouter(prefix="/v1", tags=["v1"])
+
+
+def _require_service_token(auth: AuthContext = Depends(require_read)) -> AuthContext:
+    if auth.token_source != "db" or auth.token_type != "service":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Service token required",
+        )
+    return auth
+
+
+@router.get("/user_info", response_model=UserInfoResponse)
+def get_user_info(auth: AuthContext = Depends(_require_service_token)) -> UserInfoResponse:
+    if not auth.runtime_id:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="runtime_id not assigned to this token",
+        )
+
+    from app.core.config import get_settings
+
+    settings = get_settings()
+    repo = get_portfolio_repository_from_settings(settings)
+    try:
+        user = repo.get_user(auth.user_id)  # type: ignore[arg-type]
+    finally:
+        if callable(getattr(type(repo), "close", None)):
+            repo.close()
+
+    disabled_reason: str | None = None
+    if not user.is_active:
+        disabled_reason = "account_inactive"
+
+    return UserInfoResponse(
+        user_id=user.id,
+        username=user.username,
+        email=user.email,
+        permission=user.permission,
+        is_active=user.is_active,
+        disabled_reason=disabled_reason,
+        runtime_id=auth.runtime_id,
+    )