Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

services/fraud/chaos.py

@@ -0,0 +1,22 @@
+"""blocking_event_loop -- phase-0-base-project-spec.md §7. Owned by `fraud`."""
+import hashlib
+import time
+
+from common.chaos_flags import is_enabled
+
+_CPU_WORK_SECONDS = 0.15
+
+
+async def blocking_event_loop_enabled() -> bool:
+    return await is_enabled("blocking_event_loop")
+
+
+def synchronous_cpu_work() -> None:
+    """~120ms of real, synchronous, CPU-bound work run directly inside an
+    `async def` handler -- no run_in_executor/to_thread. This is the point:
+    it blocks the whole event loop, serialising every other in-flight
+    request on this worker for the duration."""
+    deadline = time.perf_counter() + _CPU_WORK_SECONDS
+    data = b"ledgerline-fraud-scoring"
+    while time.perf_counter() < deadline:
+        data = hashlib.sha256(data).digest()