feat(#27): Gate B [07/10]: FastAPI health endpoint + app factory (H-1)

- App factory pattern (FUND-8): create_app() produces fresh app per test
- Logging config (structured, no secrets)
- Config validation: SLAB_AES_KEY required, WOO_BASE_URL HTTPS-only
- GET /api/health returns 200 {status: ok, version, woo_reachable: false}
- SQLite + alembic skeleton: full DATA-MODEL schema, initial migration
- API contract tests via httpx TestClient: 5 cases all green
  - test_returns_200, test_returns_ok_status, test_woo_reachable_false
  - test_response_shape, test_with_test_client_lifespan (FUND-9/10)

backend/tests/conftest.py

@@ -0,0 +1,45 @@
+"""Shared test fixtures for all backend tests.
+
+App factory pattern (FUND-8): each test gets a fresh app instance.
+FUND-9: TestClient manages lifespan.
+FUND-10: dependency_overrides cleared after every test.
+"""
+
+import pytest
+
+from app.config import Settings
+from app.db import engine
+from app.main import create_app
+
+
+@pytest.fixture(autouse=True)
+def _test_db() -> None:
+    """Set up a fresh in-memory SQLite database for each test."""
+    engine.set_test_url("sqlite+aiosqlite:///:memory:")
+    yield
+    engine._test_url = None
+    engine._engine = None
+    engine._session_factory = None
+
+
+@pytest.fixture
+def settings() -> Settings:
+    """Create test settings with in-memory SQLite."""
+    return Settings(
+        aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",  # 32 bytes base64
+        woo_base_url="https://test.example.com",
+        app_hostname="test.local",
+    )
+
+
+@pytest.fixture
+def app(settings: Settings) -> None:
+    """Yield a fresh FastAPI app with test settings, then clean up.
+
+    Each test gets its own app instance (FUND-8).
+    TestClient manages the lifespan (FUND-9).
+    dependency_overrides are cleared after each test (FUND-10).
+    """
+    app_instance = create_app(settings)
+    yield app_instance
+    app_instance.dependency_overrides.clear()