Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

common/http.py

@@ -0,0 +1,13 @@
+import httpx
+
+from .settings import settings
+
+
+def downstream_client(request_id: str) -> httpx.AsyncClient:
+    """An httpx.AsyncClient preconfigured with the 3s downstream timeout and
+    the X-Request-Id header forwarded, per phase-0-base-project-spec.md §9 --
+    this header is the only correlation mechanism that exists in Phase 0."""
+    return httpx.AsyncClient(
+        timeout=settings.downstream_timeout_seconds,
+        headers={"X-Request-Id": request_id},
+    )