Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

services/ledger/chaos.py

@@ -0,0 +1,28 @@
+"""pool_starvation, row_lock_contention, poison_data -- phase-0-base-project-spec.md
+§7. All three are owned by `ledger`.
+"""
+from common.chaos_flags import is_enabled
+from common.redis_client import redis_client
+
+# Populated once by scripts/seed.py: account_id -> id of that account's one
+# deliberately NULL-currency transaction (§8). A Redis hash lookup, not a
+# `transactions` scan by account_id -- that column has no supporting index
+# on purpose (§5), and the poison_data pathology shouldn't have to pay for a
+# full-table seq scan on every single request just to find its own trigger.
+POISON_TX_KEY = "poison:tx_by_account"
+
+
+async def pool_starvation_enabled() -> bool:
+    return await is_enabled("pool_starvation")
+
+
+async def row_lock_contention_enabled() -> bool:
+    return await is_enabled("row_lock_contention")
+
+
+async def poison_data_enabled() -> bool:
+    return await is_enabled("poison_data")
+
+
+async def find_poison_transaction_id(account_id: str) -> str | None:
+    return await redis_client.hget(POISON_TX_KEY, account_id)