One commit per point (audit-1..audit-7). Gate at merge: ruff 0 · 65 unit tests + 1 PG integration test · alembic 0001→0003 with PG round-trip · gitleaks clean.