feat(backend): data model — identity / clinical / audit, repositories, create_all

Two DeclarativeBases on two engines (ADR-003): identity holds direct
identifiers, clinical holds token-keyed pseudonymised data plus audit_log.
Portable types (JSONB variant, tz-aware UTC timestamps rejecting naive
values) so tests run on SQLite. init_db() runs create_all at startup.
Guardrail #5 checked by AST and import-graph tests.

Refs #6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/db/bootstrap.py

@@ -0,0 +1,17 @@
+"""Schema bootstrap: `create_all` on both databases at startup (ADR-003: no Alembic in the MVP).
+
+The only module (besides registration code) that touches both schemas — and only their metadata.
+"""
+
+from app.db import audit as _audit  # noqa: F401  (registers audit_log in clinical metadata)
+from app.db.clinical import ClinicalBase
+from app.db.identity import IdentityBase
+from app.db.session import clinical_engine, identity_engine
+
+
+async def init_db() -> None:
+    """Create missing tables in the identity and clinical databases. Idempotent."""
+    async with identity_engine().begin() as conn:
+        await conn.run_sync(IdentityBase.metadata.create_all)
+    async with clinical_engine().begin() as conn:
+        await conn.run_sync(ClinicalBase.metadata.create_all)