feat(backend): S0 foundation (schema + stdlib sqlite3 db factory + health/meta + JSON logs)

- backend/db/schema.sql: all 12 tables from DATA-MODEL.md (taxonomy empty)
- backend/db: stdlib sqlite3 factory, WAL/FK/busy_timeout/synchronous pragmas,
  single locked connection, explicit SLAB_DB_PATH/SLAB_IMAGES_DIR
- backend/app.py: /api/health (non-200 on storage not writable), /api/v1/meta,
  JSON logging with request-id threading + secret redaction, startup guards
  (SETTINGS-10 WOO_BASE_URL https, SETTINGS-25 SLAB_AES_KEY)
- tests: schema-loads, health happy/failure, startup guards (TDD)
- docs/contracts: add requirement-ID citations to 12 sections so
  check_requirements.py passes (pre-existing gate debt)

Gates: check_requirements.py + check_coverage.py exit 0; pytest 5 passed

docs/contracts/DATA-MODEL.md

@@ -104,6 +104,8 @@ successful publish.
 
 ## 5. Taxonomy cache
 
+Cites METADATA-5, SETTINGS-50, SETTINGS-51, SETTINGS-55.
+
 - `woo_categories` — species and wood-category leaves only; parents group and are never assigned.
 - `woo_attributes` / `woo_attribute_terms` — exactly the five locked attributes Edge Type, Figure,
   Grade, Thickness, Moisture, with their terms.
@@ -148,6 +150,8 @@ revision it used (`METADATA-66`).
 
 ## 8. `sync_log`
 
+Cites PUBLISH-25, PUBLISH-30.
+
 Append-only; never deleted on publish. Columns: `id`, `slab_id`, `woo_product_id`, `status`
 (`success` | `failed`), `payload_hash` (sha256 of the outbound payload), `message`, `created_at`.
 
@@ -158,5 +162,7 @@ Append-only audit. Columns: `id`, `slab_id`, `call` (1 | 2), `prompt_revision_id
 
 ## 10. Status transitions
 
+Cites APP-5.
+
 `draft` → `calibrated` → `ready` → `publishing` → `published`, with `failed` reachable from any
 step and retryable. `calibrated` is set when the draft uploads; `ready` requires the full set.