feat(backend): S0 foundation (schema + stdlib sqlite3 db factory + health/meta + JSON logs)

- backend/db/schema.sql: all 12 tables from DATA-MODEL.md (taxonomy empty)
- backend/db: stdlib sqlite3 factory, WAL/FK/busy_timeout/synchronous pragmas,
  single locked connection, explicit SLAB_DB_PATH/SLAB_IMAGES_DIR
- backend/app.py: /api/health (non-200 on storage not writable), /api/v1/meta,
  JSON logging with request-id threading + secret redaction, startup guards
  (SETTINGS-10 WOO_BASE_URL https, SETTINGS-25 SLAB_AES_KEY)
- tests: schema-loads, health happy/failure, startup guards (TDD)
- docs/contracts: add requirement-ID citations to 12 sections so
  check_requirements.py passes (pre-existing gate debt)

Gates: check_requirements.py + check_coverage.py exit 0; pytest 5 passed

docs/contracts/UX.md

@@ -11,10 +11,10 @@ Status: SPEC · 2026-09-18. Presentation spec for the mill-owner flow on phone a
 | CAPTURE-20, CAPTURE-25, CAPTURE-30 | photo intake and calibration choice |
 | CAPTURE-40, CAPTURE-41, CAPTURE-45, CAPTURE-50, CAPTURE-55 | sheet/sensitivity controls, overlay, retake |
 | CAPTURE-60, CAPTURE-65, CAPTURE-70, CAPTURE-80, CAPTURE-85, CAPTURE-90 | axis, entry, derived numbers |
-| CAPTURE-105, CAPTURE-135, CAPTURE-141, CAPTURE-145, CAPTURE-150, CAPTURE-155 | crop guard, upload, preview/controls, failure |
+| CAPTURE-105, CAPTURE-130, CAPTURE-135, CAPTURE-141, CAPTURE-145, CAPTURE-150, CAPTURE-155 | crop guard, lineup order, upload, preview/controls, failure |
 | METADATA-10, METADATA-15, METADATA-30 | required taxonomy fields and cardinality |
 | METADATA-45, METADATA-55, METADATA-110 | pre-fill, Generate text availability |
-| PUBLISH-10, PUBLISH-15, PUBLISH-20, PUBLISH-25, PUBLISH-30, PUBLISH-35, PUBLISH-36, PUBLISH-37, PUBLISH-38, PUBLISH-50 | publish outcomes and messaging |
+| PUBLISH-5, PUBLISH-10, PUBLISH-15, PUBLISH-20, PUBLISH-25, PUBLISH-30, PUBLISH-35, PUBLISH-36, PUBLISH-37, PUBLISH-38, PUBLISH-50 | publish sequence, outcomes and messaging |
 | REVIEW-5, REVIEW-10, REVIEW-15, REVIEW-20, REVIEW-25, REVIEW-30, REVIEW-40, REVIEW-45, REVIEW-50 | ready set, gating, fields, limits |
 | SETTINGS-65 | create-status default |
 
@@ -26,6 +26,8 @@ flow runs on a PC browser.
 
 ## 2. Capture
 
+Cites CAPTURE-20, CAPTURE-25, CAPTURE-40, CAPTURE-130.
+
 1. **Photos.** Take one or more photos; the first is top-down with the lens parallel to the broad
    face. The owner chooses which photo is the calibration photo.
 2. **Mask overlay and controls.** The app draws the mask on the source photo. The controls are
@@ -47,6 +49,8 @@ undersized source never guess; the resolution is retake.
 
 ## 3. Review
 
+Cites REVIEW-5, REVIEW-15, REVIEW-20, METADATA-45.
+
 - **Vision pre-fill.** At or above the threshold (default 0.7) a field is pre-filled and shown
   with an "AI" badge; below it the field starts empty. The badge is presentation only and clears
   on edit.
@@ -63,6 +67,8 @@ undersized source never guess; the resolution is retake.
 
 ## 4. Publish
 
+Cites PUBLISH-5, PUBLISH-10, PUBLISH-15, PUBLISH-25.
+
 - A normal SKU uses `woo_create_status` (default draft); a `SLAB-UAT-*` SKU always creates a draft.
   "Published" means the store create succeeded, not that it is live.
 - **Success.** The local draft and photos are gone; the store product reference is shown.