feat(broker): scaffold apps/broker workspace (bun WS runtime, no port yet)

- @claudemesh/broker package with bun dev/start scripts
- src/index.ts stub: WS server on BROKER_PORT, SIGTERM cleanup
- src/env.ts: Zod-validated env (BROKER_PORT, DATABASE_URL, STATUS_TTL_SECONDS, HOOK_FRESH_WINDOW_SECONDS)
- src/db.ts: re-exports Drizzle client from @turbostarter/db
- src/broker.ts + src/types.ts: placeholders for step 8 port
- README documents run commands, env vars, deploy targets
- tsconfig extends @turbostarter/tsconfig base
- eslint.config.js extends @turbostarter/eslint-config/base

Dependencies declared but not installed yet (ws, drizzle-orm, zod,
libsodium-wrappers + workspace deps). turbo.json unchanged: the global
dev task already has persistent=true + cache=false which is what the
broker needs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/src/env.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+
+/**
+ * Broker environment config.
+ *
+ * Validated at startup with Zod. Fails fast with a useful error if any
+ * required var is missing or malformed. Defaults mirror the values
+ * proven out in the claude-intercom prototype so local dev works
+ * without a .env file.
+ */
+const envSchema = z.object({
+  BROKER_PORT: z.coerce.number().int().positive().default(7899),
+  DATABASE_URL: z.string().min(1, "DATABASE_URL is required"),
+  STATUS_TTL_SECONDS: z.coerce.number().int().positive().default(60),
+  HOOK_FRESH_WINDOW_SECONDS: z.coerce.number().int().positive().default(30),
+  NODE_ENV: z
+    .enum(["development", "production", "test"])
+    .default("development"),
+});
+
+export type BrokerEnv = z.infer<typeof envSchema>;
+
+export function loadEnv(): BrokerEnv {
+  const parsed = envSchema.safeParse(process.env);
+  if (!parsed.success) {
+    console.error("[broker] invalid environment:");
+    console.error(z.treeifyError(parsed.error));
+    process.exit(1);
+  }
+  return parsed.data;
+}
+
+export const env = loadEnv();