feat(#27): Gate B [07/10]: FastAPI health endpoint + app factory (H-1)

- App factory pattern (FUND-8): create_app() produces fresh app per test
- Logging config (structured, no secrets)
- Config validation: SLAB_AES_KEY required, WOO_BASE_URL HTTPS-only
- GET /api/health returns 200 {status: ok, version, woo_reachable: false}
- SQLite + alembic skeleton: full DATA-MODEL schema, initial migration
- API contract tests via httpx TestClient: 5 cases all green
  - test_returns_200, test_returns_ok_status, test_woo_reachable_false
  - test_response_shape, test_with_test_client_lifespan (FUND-9/10)

backend/app/api/health.py

@@ -0,0 +1,23 @@
+"""Health endpoint router."""
+
+from fastapi import APIRouter
+
+router = APIRouter()
+
+
+@router.get("/api/health")
+async def health_check() -> dict:
+    """Deploy health and smoke path.
+
+    Returns:
+        Health status with woo_reachable flag. When Woo credentials
+        are not configured, woo_reachable is False.
+
+    Contract (OPENAPI):
+    GET /api/health → { "status": "ok", "version": "...", "woo_reachable": bool }
+    """
+    return {
+        "status": "ok",
+        "version": "0.1.0",
+        "woo_reachable": False,
+    }