feat(F-002): database foundation with migrations and dev compose

- node-pg-migrate + pg: baseline migration (extensions, app_meta) with working down
- src/infrastructure/db fail-fast pool and typed query helper
- docker-compose: postgres:16-alpine + redis:7-alpine with one-command up
- table naming convention <module>_<table> documented in README
- integration tests (6) against real PostgreSQL; strict identifier validation
  for test DDL after security-gate hardening round
- deps justified in spec/tech.md; all gates approved; verify.sh green

work/artifacts/F-002/documenter.md

@@ -0,0 +1,20 @@
+# Documenter — F-002 Database foundation with module-owned schemas
+
+done -> work/artifacts/F-002/documenter.md
+
+## Why documentation applies
+F-002 adds developer-facing contracts: database commands, migration workflow, and the table naming convention.
+
+## Documents reviewed/produced
+- `project/README.md` (updated at build stage, verified accurate):
+  - Database section lists every new script: docker:up, docker:down, db:up, db:down, db:status, test:integration — all present in package.json (cross-checked programmatically)
+  - `.env.example` copy step documented
+  - Table naming convention section: `<module>_<table>` rule, no cross-prefix queries, migrations immutable
+- `spec/tech.md`: dependency justification table extended with pg, node-pg-migrate, @types/pg (security policy requirement)
+- `specs/F-002-database-foundation/` SPEC/DESIGN/TASKS/TESTS consistent with implementation (migration filename corrected to .js at design stage)
+
+## Verification
+- package.json script keys vs README commands cross-checked: all db:/docker: commands documented; remaining scripts (build, start, test, typecheck, lint, lint:boundaries) already documented in F-001 section.
+
+## Pending docs (not this ticket)
+- Per-module data access contracts documented as each module lands (F-005+).