chore(devops): project skeleton — uv, docker compose, Makefile, CI

One Postgres with isolated identity/clinical databases and roles (ADR-003),
FastAPI /health, Streamlit placeholder, typed settings with offline defaults.

Refs #1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/postgres/init.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Creates two isolated databases (ADR-003): identity (direct identifiers) and clinical (pseudonymised data + audit).
+# Each has its own role; neither role can connect to the other database.
+set -euo pipefail
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres <<SQL
+CREATE ROLE identity_app LOGIN PASSWORD '${IDENTITY_DB_PASSWORD}';
+CREATE ROLE clinical_app LOGIN PASSWORD '${CLINICAL_DB_PASSWORD}';
+CREATE DATABASE identity OWNER identity_app;
+CREATE DATABASE clinical OWNER clinical_app;
+REVOKE CONNECT ON DATABASE identity FROM PUBLIC;
+REVOKE CONNECT ON DATABASE clinical FROM PUBLIC;
+GRANT CONNECT ON DATABASE identity TO identity_app;
+GRANT CONNECT ON DATABASE clinical TO clinical_app;
+SQL