feat(server): mint API + Postgres schema + manual adapter (PR 1)

Source-agnostic license issuance service. FastAPI app fronts a
Postgres `licenses` table; the only currently-wired source is
`manual` (operator mints via /internal/mint). Gumroad webhook
adapter lands in PR 2.

Key design points:

- Signing reuses src/license/crypto.py via a COPY into the image
  (single source of truth — blobs minted server-side verify against
  the same embedded pubkey on the buyer's machine).
- Source adapter Protocol (app/adapters/base.py) is the seam for
  Gumroad / Lemon Squeezy / Stripe in later PRs; Mint API speaks
  only SaleEvent / RefundEvent.
- (source, source_order_id) UNIQUE composite gives idempotent
  webhook retries without double-mint.
- JSONB type uses with_variant(JSON, 'sqlite') so the same models
  drive both Postgres prod and SQLite tests (no testcontainers dep).
- Bearer-token auth on /internal/*; the IP-loopback guard was
  removed after the docker bridge made it fight legitimate prod
  traffic (nginx defense + Bearer remain).
- Secrets resolved via *_FILE env vars pointing at
  /run/secrets/<name>, so passwords never appear in `docker inspect`.

21 unit tests (SQLite in-memory, StaticPool) plus a real-Postgres
docker-compose smoke test in server/scripts/smoke.sh that builds the
image, runs the alembic migration, mints a license, verifies the
signature against the host dev pubkey, and checks the DB row.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/app/db.py

@@ -0,0 +1,65 @@
+"""SQLAlchemy engine + session factory.
+
+The DB password lives in ``/run/secrets/pg_password``; we read it
+from there (or ``$PG_PASSWORD`` for local dev) and splice it into
+``DATABASE_URL`` so the password never has to be in plaintext in
+``compose.yml`` or process environment listings.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Generator
+from urllib.parse import quote_plus, urlparse, urlunparse
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import DeclarativeBase, Session, sessionmaker
+
+from app.config import get_settings
+
+
+def _resolve_password() -> str | None:
+    inline = os.environ.get("PG_PASSWORD")
+    if inline:
+        return inline.strip()
+    path = os.environ.get("PG_PASSWORD_FILE")
+    if path and Path(path).exists():
+        return Path(path).read_text(encoding="utf-8").strip()
+    return None
+
+
+def _build_url(base_url: str) -> str:
+    """Inject the resolved password into ``base_url`` if absent."""
+    parsed = urlparse(base_url)
+    if parsed.password:
+        return base_url
+    pw = _resolve_password()
+    if pw is None:
+        return base_url
+    netloc = f"{parsed.username or ''}:{quote_plus(pw)}@{parsed.hostname}"
+    if parsed.port:
+        netloc += f":{parsed.port}"
+    return urlunparse(parsed._replace(netloc=netloc))
+
+
+_settings = get_settings()
+engine = create_engine(_build_url(_settings.database_url), pool_pre_ping=True, future=True)
+SessionLocal = sessionmaker(bind=engine, autoflush=False, autocommit=False, expire_on_commit=False)
+
+
+class Base(DeclarativeBase):
+    """Declarative base for ORM models."""
+
+
+def get_session() -> Generator[Session, None, None]:
+    """FastAPI dependency. Commits on success, rolls back on exception."""
+    session = SessionLocal()
+    try:
+        yield session
+        session.commit()
+    except Exception:
+        session.rollback()
+        raise
+    finally:
+        session.close()