feat(#27): Gate B [07/10]: FastAPI health endpoint + app factory (H-1)

- App factory pattern (FUND-8): create_app() produces fresh app per test
- Logging config (structured, no secrets)
- Config validation: SLAB_AES_KEY required, WOO_BASE_URL HTTPS-only
- GET /api/health returns 200 {status: ok, version, woo_reachable: false}
- SQLite + alembic skeleton: full DATA-MODEL schema, initial migration
- API contract tests via httpx TestClient: 5 cases all green
  - test_returns_200, test_returns_ok_status, test_woo_reachable_false
  - test_response_shape, test_with_test_client_lifespan (FUND-9/10)

backend/tests/contract/test_health.py

@@ -0,0 +1,113 @@
+"""H-1: Health endpoint contract test.
+
+Tests via httpx TestClient. Each test gets a fresh app instance (FUND-8).
+
+H-1: GET /api/health returns 200 {status: ok} with woo_reachable false
+when credentials are not configured.
+
+FUND-8: App factory creates fresh instance per test.
+FUND-9: TestClient context manager manages lifespan.
+FUND-10: dependency_overrides cleared after every test.
+"""
+
+from fastapi.testclient import TestClient
+
+from app.main import create_app
+
+
+class TestHealthEndpoint:
+    """GET /api/health contract tests."""
+
+    def test_returns_200(self) -> None:
+        """H-1: Health endpoint returns 200."""
+        from app.config import Settings
+
+        settings = Settings(
+            aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",
+            woo_base_url="https://test.example.com",
+        )
+        app = create_app(settings)
+        client = TestClient(app)
+
+        response = client.get("/api/health")
+        assert response.status_code == 200
+
+        client.close()
+        app.dependency_overrides.clear()
+
+    def test_returns_ok_status(self) -> None:
+        """H-1: Health endpoint returns status ok."""
+        from app.config import Settings
+
+        settings = Settings(
+            aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",
+            woo_base_url="https://test.example.com",
+        )
+        app = create_app(settings)
+        client = TestClient(app)
+
+        response = client.get("/api/health")
+        data = response.json()
+        assert data["status"] == "ok"
+
+        client.close()
+        app.dependency_overrides.clear()
+
+    def test_woo_reachable_false_when_credentials_not_configured(self) -> None:
+        """H-1: woo_reachable is false when Woo credentials not configured."""
+        from app.config import Settings
+
+        settings = Settings(
+            aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",
+            woo_base_url="https://test.example.com",
+        )
+        app = create_app(settings)
+        client = TestClient(app)
+
+        response = client.get("/api/health")
+        data = response.json()
+        assert data["woo_reachable"] is False
+
+        client.close()
+        app.dependency_overrides.clear()
+
+    def test_response_shape(self) -> None:
+        """H-1: Response contains exactly status, version, and woo_reachable."""
+        from app.config import Settings
+
+        settings = Settings(
+            aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",
+            woo_base_url="https://test.example.com",
+        )
+        app = create_app(settings)
+        client = TestClient(app)
+
+        response = client.get("/api/health")
+        data = response.json()
+
+        assert "status" in data
+        assert "version" in data
+        assert "woo_reachable" in data
+        assert isinstance(data["status"], str)
+        assert isinstance(data["version"], str)
+        assert isinstance(data["woo_reachable"], bool)
+
+        client.close()
+        app.dependency_overrides.clear()
+
+    def test_with_test_client_lifespan(self) -> None:
+        """FUND-9: TestClient with app manages lifespan correctly."""
+        from app.config import Settings
+
+        settings = Settings(
+            aes_key="dGVzdC1rZXktZm9yLW1hbGxlb3AtdGVzdGluZy1vbmx5LXNob3VsZC1iZS11c2Vk",
+            woo_base_url="https://test.example.com",
+        )
+        app = create_app(settings)
+
+        with TestClient(app) as client:
+            response = client.get("/api/health")
+            assert response.status_code == 200
+            assert response.json()["status"] == "ok"
+
+        app.dependency_overrides.clear()