Add monorepo scaffolding and project documentation

Sets up the Nuvolari monorepo layout (app/, backend/, docs/, tool/) with the
groundwork that does not depend on the Flutter toolchain: gitignore covering
Flutter, Python and every secret file shape; env.example.json as the template
for --dart-define-from-file; a verification script that skips stages whose
target does not exist yet so it is runnable from day one; and a CI workflow in
GitHub Actions syntax so it runs unchanged on Gitea or GitHub.

The documentation records facts verified against the live services rather than
restated from the brief. Two of them change the design:

- DPC VMI rasters are 1200x1400 Float32 on a 1 km grid in a custom projection
  centred on Italy, not EPSG:4326 or EPSG:3857, and their GeoKeys are
  internally inconsistent. Reprojection is mandatory and the source CRS must be
  read from each file rather than hardcoded.
- The ARPA CAP feed carries six level values, not four: BIANCO for the
  avalanche scale out of season and "-" for no data. Collapsing either into
  VERDE would report "no alert" where the bulletin reports "not assessed".

Also documents why the frames we publish inherit CC BY-SA from the DPC source,
and why rain notifications subscribe to cell topics from the device so no user
location ever reaches a server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Nuvolari/docs/licenses.md

@@ -0,0 +1,57 @@
+# Licenses and attribution obligations
+
+Nuvolari redistributes third-party data. Every obligation below is binding: the
+Sources screen in the app must satisfy all of them, and none of them may be dropped
+to save screen space.
+
+## Summary
+
+| Data | License | Mandatory credit | Notes |
+|---|---|---|---|
+| Radar-DPC rasters | CC BY-SA | "Radar-DPC" | **Share-alike propagates to our frames** |
+| ARPA Piemonte radar | CC BY 4.0 | "Fonte: Arpa Piemonte - www.arpa.piemonte.it" | Adapter disabled, unused |
+| MET Norway forecast | CC BY 4.0 | "MET Norway" | Identifying User-Agent required |
+| ItaliaMeteo ICON-2I | CC BY 4.0 | "ItaliaMeteo-ARPAE" | Fallback, behind a flag |
+| ARPA Piemonte alerts | not stated | "Arpa Piemonte" + link to the official bulletin | Levels republished verbatim |
+| OpenStreetMap base map | ODbL | "© OpenStreetMap contributors" | Must stay visible on the map |
+
+## Share-alike is the constraint that shapes the backend
+
+The Radar-DPC rasters are **CC BY-SA**. The PNG frames the worker produces — cropped,
+reprojected, colourised — are a derived product, so they inherit CC BY-SA. Practical
+consequences:
+
+- The published frames and `manifest.json` are CC BY-SA and must be labelled as such.
+- We cannot relicense them, and we cannot restrict their reuse.
+- The share-alike obligation covers the **data**, not the app's source code or UI.
+
+## MET Norway User-Agent
+
+MET Norway blocks generic User-Agent strings. Requests must carry an identifying
+string with a real contact address:
+
+```
+Nuvolari/<version> (<contact address>)
+```
+
+The contact comes from `METNO_USER_AGENT_CONTACT` in `env.json` and is never hardcoded.
+The `Expires` header must be honoured — re-requesting before expiry risks a block.
+
+## Not usable
+
+- **Blitzortung** — commercial use prohibited. This app carries ads, so it is
+  commercial. Never integrate it.
+- **Open-Meteo free tier** — non-commercial only. Same reasoning.
+
+## Naming and independence
+
+The app must never appear to be an official ARPA or Protezione Civile product:
+
+- no ARPA/DPC logos, coats of arms or institutional branding;
+- never the word "ufficiale" applied to the app itself (the *bulletin* is official —
+  the *app* is not);
+- the Sources screen carries an explicit disclaimer that Nuvolari is an independent
+  app, not affiliated with, endorsed by, or operated by ARPA Piemonte or the
+  Dipartimento della Protezione Civile;
+- for civil-protection purposes the official channels always prevail, and the app
+  says so next to every alert.