Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

services/insights/db.py

@@ -0,0 +1,25 @@
+"""insights gets its own engines, separate from common.db's shared default,
+so pool sizing here can be tuned independently of sanctions/notifier/audit
+(which also import common.db).
+
+Two pools, selected per-request: a generous default, and a small one used
+whenever unbounded_cache is on -- every request is then a guaranteed fresh
+miss needing a real connection, and under concurrent load that alone is
+enough demand to exhaust a small pool. This is a realistic capacity limit
+that emerges under load, not a 14th named chaos flag."""
+from sqlalchemy.ext.asyncio import async_sessionmaker
+
+from common.db import make_engine
+
+normal_engine = make_engine(pool_size=20, max_overflow=10)
+starved_engine = make_engine(pool_size=5, max_overflow=3, pool_timeout=0.5)
+
+NormalSession = async_sessionmaker(normal_engine, expire_on_commit=False)
+StarvedSession = async_sessionmaker(starved_engine, expire_on_commit=False)
+
+# Exposed for readyz's connectivity check.
+engine = normal_engine
+
+
+def session_factory(starved: bool):
+    return StarvedSession() if starved else NormalSession()