feat(m1): DB schema, migrations, diag visibility

23 tables + alembic_version covering the v1 data model:
- Auth/RBAC (8): users, groups, permissions, user_groups, group_permissions,
  invitations, invitation_groups, refresh_tokens.
- MITRE (4): mitre_tactics, mitre_techniques, mitre_subtechniques + the
  technique↔tactic many-to-many.
- Templates (4): test_templates, test_template_mitre_tags (3 nullable FKs +
  CHECK exactly_one_mitre_fk), scenario_templates, scenario_template_tests
  (UUID PK + UNIQUE(scenario_id, position) so a test can appear at multiple
  positions).
- Missions (6): missions, mission_members, mission_scenarios, mission_tests,
  mission_test_mitre_tags (deliberately denormalised — copies external_id +
  name + url, no FK to mitre_* — so a re-sync of the catalogue can't purge
  historical tags), mission_categories.
- Evidence/settings/notifications (5): evidence_files, settings (JSONB
  value), detection_levels, notifications.

SQLAlchemy 2.x with Mapped[]/mapped_column(), pk_/fk_/ck_/uq_/ix_ naming
convention. Reusable mixins (UuidPkMixin, TimestampMixin, SoftDeleteMixin —
no auto __table_args__ since classes silently clobber the mixin's).

Soft delete: deleted_at + partial indexes ix_<table>_active WHERE deleted_at
IS NULL on 9 tables (users, groups, test_templates, scenario_templates,
missions, mission_scenarios, mission_tests, mission_categories,
evidence_files). Notifications gets ix_..._unread WHERE read_at IS NULL.

CHECK constraints for status / state / opsec_level / mitre_kind enums.

New API endpoint GET /api/v1/diag/db: returns alembic_revision (short hash)
and the public-schema table_count. 503 with {"reachable": false} on a DB
outage. Database card on the SPA home consumes it.

Test stage in backend/Dockerfile (--target test): runtime + dev extras +
tests/. New make test-api spins an ephemeral pytest container against the
live DB on the compose network. backend/tests/test_schema.py: 8 integration
tests (tables, FK pairs, CHECK constraints, partial indexes, alembic-at-head,
negative INSERT proving the exactly_one_mitre_fk CHECK fires).

e2e/tests/m1-db.spec.ts: 4 Playwright tests covering the diag endpoint
contract + the Database card + footer/roadmap labels.

DoD: make clean && make up && make migrate → 23 tables, 32 FKs, 9 CHECKs,
make test-api → 9 passed, make e2e → 12 passed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -0,0 +1,73 @@
+"""ORM models — every module must be imported here so Alembic's autogenerate
+can see them via `Base.metadata`.
+"""
+
+from app.models.auth import (
+    Group,
+    GroupPermission,
+    Invitation,
+    InvitationGroup,
+    Permission,
+    RefreshToken,
+    User,
+    UserGroup,
+)
+from app.models.evidence import EvidenceFile
+from app.models.mission import (
+    Mission,
+    MissionCategory,
+    MissionMember,
+    MissionScenario,
+    MissionTest,
+    MissionTestMitreTag,
+)
+from app.models.mitre import (
+    MitreSubtechnique,
+    MitreTactic,
+    MitreTechnique,
+    MitreTechniqueTactic,
+)
+from app.models.notification import Notification
+from app.models.setting import DetectionLevel, Setting
+from app.models.template import (
+    ScenarioTemplate,
+    ScenarioTemplateTest,
+    TestTemplate,
+    TestTemplateMitreTag,
+)
+
+__all__ = [
+    # auth
+    "Group",
+    "GroupPermission",
+    "Invitation",
+    "InvitationGroup",
+    "Permission",
+    "RefreshToken",
+    "User",
+    "UserGroup",
+    # evidence
+    "EvidenceFile",
+    # mission
+    "Mission",
+    "MissionCategory",
+    "MissionMember",
+    "MissionScenario",
+    "MissionTest",
+    "MissionTestMitreTag",
+    # mitre
+    "MitreSubtechnique",
+    "MitreTactic",
+    "MitreTechnique",
+    "MitreTechniqueTactic",
+    # notification
+    "Notification",
+    # setting
+    "DetectionLevel",
+    "Setting",
+    # template
+    "ScenarioTemplate",
+    "ScenarioTemplateTest",
+    "TestTemplate",
+    "TestTemplateMitreTag",
+]