Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

services/fraud/scoring.py

@@ -0,0 +1,18 @@
+import random
+
+
+def category_weight(category_id: int | None) -> float:
+    """A fake but deterministic-ish stand-in for merchant_categories.risk_weight
+    (fraud has no direct DB access -- Redis only, per phase-0-base-project-spec.md §4).
+    The business logic does not need to be correct, only to produce a plausible
+    spread of scores."""
+    if category_id is None:
+        return 0.3
+    return 0.01 + (category_id % 45) / 44 * 0.94
+
+
+def score(category_id: int | None, matched: bool) -> float:
+    base = category_weight(category_id) * random.uniform(0.05, 0.3)
+    if matched:
+        return min(1.0, base + random.uniform(0.55, 0.9))
+    return min(1.0, base)