feat(F-002): database foundation with migrations and dev compose

- node-pg-migrate + pg: baseline migration (extensions, app_meta) with working down
- src/infrastructure/db fail-fast pool and typed query helper
- docker-compose: postgres:16-alpine + redis:7-alpine with one-command up
- table naming convention <module>_<table> documented in README
- integration tests (6) against real PostgreSQL; strict identifier validation
  for test DDL after security-gate hardening round
- deps justified in spec/tech.md; all gates approved; verify.sh green

work/artifacts/F-002/reviewer.json

@@ -0,0 +1,31 @@
+{
+  "feature_id": "F-002",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Database foundation matches specs/F-002 DESIGN.md. Migration tooling demonstrated against real PostgreSQL 16, pool helper fail-fast, compose one-command dev environment, naming convention documented. No blockers.",
+  "checks": {
+    "design_conformance": "PASS: src/infrastructure/db/pool.ts, migrations/001_baseline.js, docker-compose.yml, npm scripts all present as designed; --env-file-if-exists used instead of strict --env-file (safer, equivalent intent)",
+    "migration_lifecycle": "PASS (re-executed by reviewer): db:up applies 001_baseline; db:down reverts; db:up re-applies; second up is no-op",
+    "naming_convention": "PASS: <module>_<table> documented in README with rules; baseline table app_meta follows prefix rule; no business tables introduced",
+    "test_hygiene": "PASS: integration tests skip explicitly without TEST_DATABASE_URL (npm test green without DB); shared-DB race resolved by disabling fileParallelism with inline justification",
+    "boundary_rules": "PASS: lint:boundaries clean over 11 files; db code lives in infrastructure, no module touched"
+  },
+  "findings": [
+    {
+      "severity": "info",
+      "note": "node-pg-migrate programmatic runner needs explicit migrationsTable; test helper pins 'pgmigrations' to match CLI default. Documented in implementer.md known limitations."
+    },
+    {
+      "severity": "info",
+      "note": "F-004 will centralize config; current minimal fail-fast env reader in pool.ts is acceptable and called out as follow-up."
+    }
+  ],
+  "evidence": [
+    "npm run lint / typecheck / lint:boundaries / test -> all exit 0",
+    "npm run test:integration -> Test Files 2 passed (2), Tests 6 passed (6) against PostgreSQL 16 in docker",
+    "reviewer re-run: db:down then db:up -> 001_baseline DOWN then UP, Migrations complete",
+    "docker exec mdv-dev-redis redis-cli ping -> PONG (from build stage)",
+    "files reviewed: project/migrations/001_baseline.js, src/infrastructure/db/**, docker-compose.yml, scripts/db-status.mjs, README.md, spec/tech.md"
+  ],
+  "timestamp": "2026-08-14T19:57:00Z"
+}