feat(phase-34): resolve blocking tech debt — Redis, domain exceptions, indexes, CI

Foundational changes required before any new feature work can begin.

- 0.1 Redis infrastructure: add redis:7-alpine to docker-compose dev and prod,
  REDIS_URL config, singleton client in app/infrastructure/redis_client.py
- 0.2 Token blacklist on Redis SEC-001: replace in-memory dict with Redis SETEX
  keyed by jti, auto-expiring TTL derived from token exp
- 0.3 Database indexes SR-006: Alembic migration b019 with 5 composite indexes
  for scoring, MTTD/MTTR, remediation, and notification queries
- 0.4 Domain exceptions TD-003: app/domain/exceptions.py with typed errors,
  error_handler middleware mapping them to HTTP, services decoupled from FastAPI
- 0.5 Fix silenced exceptions TD-007: replace 4 bare except-pass blocks in
  test_workflow_service with logger.warning with exc_info
- 0.6 CI pipeline TD-009: GitHub Actions workflow with Postgres and Redis
  service containers, ruff lint, pytest; ruff.toml for baseline config

backend/ruff.toml

@@ -0,0 +1,13 @@
+[lint]
+# Ignore rules that have widespread pre-existing violations.
+# These can be cleaned up incrementally in follow-up PRs.
+ignore = [
+    "E402",   # module-level import not at top of file (app.main, some services)
+    "E712",   # == True comparisons (required by SQLAlchemy filter syntax)
+    "F401",   # unused imports (widespread; clean up incrementally)
+    "F841",   # unused local variables (a few occurrences)
+]
+
+[lint.per-file-ignores]
+# Test files may use broad exception catching and unusual import patterns
+"tests/**" = ["E", "F"]