feat: add user model with serialization

[vinimachadosantana]

What

Adds the User model with validations, an Alba serializer, a GET /api/v1/users/:id endpoint, and specs covering both the model and the endpoint.

Why

The first domain object, and the one authentication builds on next phase. It also exercises the error contract end to end.

How

• Alba instead of AMS.
• The serializer as an explicit allowlist.
• Uniqueness is enforced by a database index as well as a validation, as only the index actually guarantees correctness.
• User.find raises RecordNotFound, which the base controller already converts to a structured 404, so the controller needs no branching.
• Emails are normalised before validation so case and whitespace can't create duplicates.

Testing

• Model specs cover validations, normalisation and format
• Request specs cover the happy path and the 404 error contract
• RuboCop and Brakeman clean, CI green