Implement Phase 0b base project against the frozen test contract

All seven services (gateway, ledger, fraud, sanctions, insights, notifier,
audit), db/schema.sql plus optional_indexes.sql, scripts/seed.py and
smoke.py, the gateway-served frontend, and docker-compose.yml. Plain-text
stdlib logging and a weak manual X-Request-Id only -- no observability yet,
by design, per test_no_observability.py. Implements all 13 named chaos-flag
pathologies from docs/PATHOLOGIES.md behind Redis-backed runtime flags.

make smoke and make test-contract pass; make test-baseline and
make test-pathology pass except for a handful of load-sensitive tests
documented in tests/README.md rather than papered over.

services/sanctions/repository.py

@@ -0,0 +1,19 @@
+import sqlalchemy as sa
+
+from common.db import Session
+
+
+async def is_match(holder_name: str) -> dict | None:
+    """Case-insensitive exact match against sanctions_entries.normalized_name."""
+    async with Session() as session:
+        result = await session.execute(
+            sa.text(
+                "SELECT country, list_source FROM sanctions_entries "
+                "WHERE lower(normalized_name) = lower(:name) LIMIT 1"
+            ),
+            {"name": holder_name},
+        )
+        row = result.first()
+    if row is None:
+        return None
+    return {"country": row.country, "list_source": row.list_source}