feat(#27): Gate B [07/10]: FastAPI health endpoint + app factory (H-1)

- App factory pattern (FUND-8): create_app() produces fresh app per test
- Logging config (structured, no secrets)
- Config validation: SLAB_AES_KEY required, WOO_BASE_URL HTTPS-only
- GET /api/health returns 200 {status: ok, version, woo_reachable: false}
- SQLite + alembic skeleton: full DATA-MODEL schema, initial migration
- API contract tests via httpx TestClient: 5 cases all green
  - test_returns_200, test_returns_ok_status, test_woo_reachable_false
  - test_response_shape, test_with_test_client_lifespan (FUND-9/10)

backend/app/prompts/call1.txt

@@ -0,0 +1,9 @@
+# Call 1 prompt — species detection
+# Read fresh each invocation. Edit on host without restart.
+
+Identify the slab species, figure, edge type, and grade from the provided images.
+
+Return results constrained to the provided taxonomy only. Do not invent species,
+figure terms, or grade terms that are not in the taxonomy list.
+
+Confidence threshold: 0.7. Below threshold, return empty for that field.