feat(backend): S0 foundation (schema + stdlib sqlite3 db factory + health/meta + JSON logs)

- backend/db/schema.sql: all 12 tables from DATA-MODEL.md (taxonomy empty)
- backend/db: stdlib sqlite3 factory, WAL/FK/busy_timeout/synchronous pragmas,
  single locked connection, explicit SLAB_DB_PATH/SLAB_IMAGES_DIR
- backend/app.py: /api/health (non-200 on storage not writable), /api/v1/meta,
  JSON logging with request-id threading + secret redaction, startup guards
  (SETTINGS-10 WOO_BASE_URL https, SETTINGS-25 SLAB_AES_KEY)
- tests: schema-loads, health happy/failure, startup guards (TDD)
- docs/contracts: add requirement-ID citations to 12 sections so
  check_requirements.py passes (pre-existing gate debt)

Gates: check_requirements.py + check_coverage.py exit 0; pytest 5 passed

docs/contracts/PROMPTS.md

@@ -39,6 +39,8 @@ The interface is reachable on the trusted network only until it is authenticated
 
 ## 3. Call 1 — vision classification
 
+Cites METADATA-35, METADATA-40, METADATA-45, METADATA-50.
+
 **When.** Runs automatically after a calibrated draft uploads only when `inference_enabled` is
 true; also on demand or retry. With inference off it is skipped and the fields are filled by hand.