Scaffold dd0c/run: Rust agent (classifier, executor, audit) + TypeScript SaaS

- Rust agent: clap CLI, command classifier (read-only/modifying/destructive), executor with approval gates, audit log entries
- Classifier: pattern-based safety classification for shell, AWS, kubectl, terraform/tofu commands
- 6 Rust tests: read-only, destructive, modifying, empty, terraform apply, tofu destroy
- SaaS backend: Fastify server, runbook CRUD API, approval API, Slack interactive handler
- Slack integration: signature verification, block_actions for approve/reject buttons
- PostgreSQL schema with RLS: runbooks, executions, audit_entries (append-only), agents
- Dual Dockerfiles: Rust multi-stage (agent), Node multi-stage (SaaS)
- Gitea Actions CI: Rust test+clippy, Node typecheck+test
- Fly.io config for SaaS

products/06-runbook-automation/saas/src/index.ts

@@ -0,0 +1,31 @@
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import helmet from '@fastify/helmet';
+import pino from 'pino';
+import { config } from './config/index.js';
+import { registerRunbookRoutes } from './api/runbooks.js';
+import { registerApprovalRoutes } from './api/approvals.js';
+import { registerSlackRoutes } from './slackbot/handler.js';
+
+const logger = pino({ name: 'dd0c-run', level: config.LOG_LEVEL });
+
+const app = Fastify({ logger: true });
+
+await app.register(cors, { origin: config.CORS_ORIGIN });
+await app.register(helmet);
+
+// Health check
+app.get('/health', async () => ({ status: 'ok', service: 'dd0c-run' }));
+
+// API routes
+registerRunbookRoutes(app);
+registerApprovalRoutes(app);
+registerSlackRoutes(app);
+
+try {
+  await app.listen({ port: config.PORT, host: '0.0.0.0' });
+  logger.info({ port: config.PORT }, 'dd0c/run SaaS started');
+} catch (err) {
+  logger.fatal(err, 'Failed to start');
+  process.exit(1);
+}