feat(F-002): database foundation with migrations and dev compose

- node-pg-migrate + pg: baseline migration (extensions, app_meta) with working down
- src/infrastructure/db fail-fast pool and typed query helper
- docker-compose: postgres:16-alpine + redis:7-alpine with one-command up
- table naming convention <module>_<table> documented in README
- integration tests (6) against real PostgreSQL; strict identifier validation
  for test DDL after security-gate hardening round
- deps justified in spec/tech.md; all gates approved; verify.sh green

specs/F-002-database-foundation/TESTS.md

@@ -0,0 +1,25 @@
+# TESTS — F-002 Database foundation with module-owned schemas
+
+## Integration (Vitest, `*.itest.ts`, run with TEST_DATABASE_URL set)
+- `migrations.itest.ts`:
+  - fresh database + `migrate up` → `app_meta` exists
+  - second `migrate up` → no-op (no errors, same state)
+  - `migrate down` → `app_meta` gone
+- `pool.itest.ts`:
+  - `createPoolFromEnv` connects and `SELECT 1` roundtrip
+  - insert/read/delete row in `app_meta` via query helper
+
+## Manual/CI commands
+- `npm run docker:up` starts PostgreSQL + Redis with one command
+- `npm run db:up` on fresh DB exits 0; second run exits 0 with nothing applied
+- `npm run db:down` exits 0 and drops baseline objects
+- `npm test` stays green even without TEST_DATABASE_URL (integration tests skip explicitly)
+
+## Acceptance traceability
+| Criterion | Evidence |
+|---|---|
+| fresh up creates schema, rerun is no-op | migrations.itest.ts + db:up twice in implementer.md |
+| down rolls back cleanly | migrations.itest.ts + db:down output |
+| naming convention documented/enforced | README section + baseline migration exemplar |
+| dev DBs start with one command | docker compose up output |
+| verify.sh green | qa.json evidence |