feat(block1): inventory walking skeleton + first quick-add slice

Stand up the Tanemaki monorepo and the first end-to-end vertical slice of
Block 1 (offline, encrypted inventory): add a seed → see it in a categorized,
searchable list → it persists → reopen and it's still there.

Architecture (state management like G1nkgo, adapted to Tane's reality):
- flutter_bloc (Cubit-first), but the encrypted Drift DB is the single source
  of truth; cubits stream from repositories (no hydrated_bloc/Hive, which would
  write plaintext at rest).
- get_it composition root; go_router; slang i18n (ES/EN, Weblate-friendly JSON).

Workspace & core:
- pub workspace: packages/commons_core (pure Dart) + apps/app_seeds (Flutter).
- commons_core primitives: UUIDv7 IdGen, Hybrid Logical Clock, Quantity value
  type (+ plant-aware QuantityKind), IdentityService root-seed stub.

Data & security:
- Drift schemaVersion=1 with all 10 Block-1 tables + common CRDT columns
  (HLC updated_at, last_author, tombstones); Movement append-only.
- SQLCipher via an injectable executor that refuses to open a plaintext DB;
  DB key + root seed in the OS keystore (separate secrets).
- Exported drift_schema_v1.json + migration scaffold.

Tests (near-TDD; nothing merges without tests):
- commons_core units (24), Drift migration test, "no plaintext at rest"
  security guard (runs where SQLCipher is present, skips otherwise),
  repository, widget, full quick-add flow, file-reopen persistence, and a
  no-hardcoded-strings i18n guard. GitLab CI: format + analyze + test + coverage.

Follow-on Block-1 stories (item detail/edit, species catalog, germination UI)
and all of Block 2 remain out of scope.

apps/app_seeds/test/db/migration_test.dart

@@ -0,0 +1,21 @@
+import 'package:drift_dev/api/migrations_native.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tane/db/database.dart';
+
+import 'schema/schema.dart';
+
+void main() {
+  late SchemaVerifier verifier;
+
+  setUpAll(() {
+    verifier = SchemaVerifier(GeneratedHelper());
+  });
+
+  test('freshly created database matches the exported schema v1', () async {
+    // Guards that `createAll` stays in sync with drift_schemas/drift_schema_v1.json.
+    final schema = await verifier.schemaAt(1);
+    final db = AppDatabase(schema.newConnection());
+    await verifier.migrateAndValidate(db, 1);
+    await db.close();
+  });
+}

apps/app_seeds/test/db/no_plaintext_test.dart

@@ -0,0 +1,80 @@
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:path/path.dart' as p;
+import 'package:tane/db/database.dart';
+import 'package:tane/db/encrypted_executor.dart';
+
+/// Security regression guard for "no plaintext at rest, ever" (CLAUDE.md).
+///
+/// Writes a Variety whose label is a unique sentinel, then reads the raw
+/// database file bytes and asserts the sentinel does NOT appear — proving
+/// SQLCipher actually encrypted the data.
+///
+/// Requires a real SQLCipher library. On a host without it (no
+/// `libsqlcipher.so`), the test is skipped with a clear reason; CI installs
+/// SQLCipher so the guard runs there. It also runs on-device via integration
+/// tests.
+void main() {
+  test('sentinel label is absent from the raw encrypted DB file', () async {
+    const sentinel = 'GRANDMA_TOMATO_SENTINEL_9f3a1c';
+    const keyHex =
+        '00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff';
+
+    final dir = await Directory.systemTemp.createTemp('tane_enc_test');
+    final file = File(p.join(dir.path, 'inventory.sqlite'));
+    addTearDown(() => dir.delete(recursive: true));
+
+    final db = AppDatabase(openEncryptedExecutor(file, keyHex));
+    try {
+      await db
+          .into(db.varieties)
+          .insert(
+            VarietiesCompanion.insert(
+              id: 'sentinel-row',
+              label: sentinel,
+              createdAt: 0,
+              updatedAt: '0',
+              lastAuthor: 'test',
+            ),
+          );
+    } on Object catch (e) {
+      // SQLCipher not available in this environment (e.g. dev host without
+      // libsqlcipher). Skip rather than pass silently.
+      markTestSkipped('SQLCipher unavailable, cannot verify encryption: $e');
+      await db.close();
+      return;
+    }
+    await db.close();
+
+    final bytes = await file.readAsBytes();
+    expect(
+      _containsAscii(bytes, sentinel),
+      isFalse,
+      reason: 'Label leaked as plaintext — SQLCipher encryption is not active.',
+    );
+    // Sanity: a real SQLCipher file does not start with the plain-SQLite header.
+    expect(
+      _containsAscii(bytes.sublist(0, 16), 'SQLite format 3'),
+      isFalse,
+      reason: 'File has a plaintext SQLite header — not encrypted.',
+    );
+  });
+}
+
+bool _containsAscii(Uint8List haystack, String needle) {
+  final n = needle.codeUnits;
+  if (n.isEmpty || haystack.length < n.length) return false;
+  for (var i = 0; i <= haystack.length - n.length; i++) {
+    var match = true;
+    for (var j = 0; j < n.length; j++) {
+      if (haystack[i + j] != n[j]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) return true;
+  }
+  return false;
+}

apps/app_seeds/test/db/schema/schema.dart

@@ -0,0 +1,21 @@
+// dart format width=80
+// GENERATED BY drift_dev, DO NOT MODIFY.
+// ignore_for_file: type=lint,unused_import
+//
+import 'package:drift/drift.dart';
+import 'package:drift/internal/migrations.dart';
+import 'schema_v1.dart' as v1;
+
+class GeneratedHelper implements SchemaInstantiationHelper {
+  @override
+  GeneratedDatabase databaseForVersion(QueryExecutor db, int version) {
+    switch (version) {
+      case 1:
+        return v1.DatabaseAtV1(db);
+      default:
+        throw MissingSchemaException(version, versions);
+    }
+  }
+
+  static const versions = const [1];
+}