feat(phase-34): resolve blocking tech debt — Redis, domain exceptions, indexes, CI

Foundational changes required before any new feature work can begin.

- 0.1 Redis infrastructure: add redis:7-alpine to docker-compose dev and prod,
  REDIS_URL config, singleton client in app/infrastructure/redis_client.py
- 0.2 Token blacklist on Redis SEC-001: replace in-memory dict with Redis SETEX
  keyed by jti, auto-expiring TTL derived from token exp
- 0.3 Database indexes SR-006: Alembic migration b019 with 5 composite indexes
  for scoring, MTTD/MTTR, remediation, and notification queries
- 0.4 Domain exceptions TD-003: app/domain/exceptions.py with typed errors,
  error_handler middleware mapping them to HTTP, services decoupled from FastAPI
- 0.5 Fix silenced exceptions TD-007: replace 4 bare except-pass blocks in
  test_workflow_service with logger.warning with exc_info
- 0.6 CI pipeline TD-009: GitHub Actions workflow with Postgres and Redis
  service containers, ruff lint, pytest; ruff.toml for baseline config

backend/tests/test_workflow.py

@@ -37,10 +37,13 @@ if "app.config" not in sys.modules:
         SECRET_KEY = "test"
         ALGORITHM = "HS256"
         ACCESS_TOKEN_EXPIRE_MINUTES = 60
+        REDIS_URL = "redis://localhost:6379/0"
         MINIO_ENDPOINT = "localhost:9000"
         MINIO_ACCESS_KEY = "test"
         MINIO_SECRET_KEY = "test"
         MINIO_BUCKET = "test"
+        MINIO_SECURE = False
+        MAX_RETEST_COUNT = 3
     _cfg.settings = _FakeSettings()
     sys.modules["app.config"] = _cfg
 
@@ -72,6 +75,7 @@ for _mod in [
 # ---------------------------------------------------------------------------
 
 from fastapi import HTTPException
+from app.domain.exceptions import InvalidOperationError, InvalidTransitionError
 from app.models.enums import TestState, TestResult
 from app.services.test_workflow_service import (
     VALID_TRANSITIONS,
@@ -208,7 +212,7 @@ def test_rejection_and_reopen(mock_log):
 
 @patch("app.services.test_workflow_service.log_action")
 def test_invalid_transitions(mock_log):
-    """Verify that invalid state transitions raise HTTPException."""
+    """Verify that invalid state transitions raise InvalidTransitionError."""
     db = _make_db()
     user = _make_user("admin")
 
@@ -216,41 +220,41 @@ def test_invalid_transitions(mock_log):
     test = _make_test(TestState.draft)
     try:
         transition_state(db, test, TestState.validated, user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # draft -> blue_evaluating (should fail)
     test = _make_test(TestState.draft)
     try:
         transition_state(db, test, TestState.blue_evaluating, user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # red_executing -> in_review (should fail, must go through blue_evaluating)
     test = _make_test(TestState.red_executing)
     try:
         transition_state(db, test, TestState.in_review, user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # validated -> anything (terminal state)
     test = _make_test(TestState.validated)
     try:
         transition_state(db, test, TestState.draft, user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # rejected -> red_executing (must go through draft first)
     test = _make_test(TestState.rejected)
     try:
         transition_state(db, test, TestState.red_executing, user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
 
 # ===========================================================================
@@ -268,17 +272,17 @@ def test_red_tech_cannot_access_blue_phase(mock_log):
     test = _make_test(TestState.red_executing)
     try:
         submit_blue_evidence(db, test, red_tech)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # Red tech cannot validate (test must be in blue_evaluating for submit_blue)
     test2 = _make_test(TestState.draft)
     try:
         submit_blue_evidence(db, test2, red_tech)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
 
 # ===========================================================================
@@ -298,17 +302,17 @@ def test_blue_tech_cannot_access_red_phase(mock_log):
     test = _make_test(TestState.blue_evaluating)
     try:
         start_execution(db, test, blue_tech)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
     # Blue tech cannot submit red evidence on a draft test
     test2 = _make_test(TestState.draft)
     try:
         submit_red_evidence(db, test2, blue_tech)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        assert False, "Should have raised InvalidTransitionError"
+    except InvalidTransitionError as exc:
+        assert exc.code == "INVALID_TRANSITION"
 
 
 # ===========================================================================
@@ -509,15 +513,15 @@ def test_cannot_validate_outside_in_review(mock_log):
         try:
             validate_as_red_lead(db, test, red_lead, "approved", "OK")
             assert False, f"Red Lead should not validate in {state.value}"
-        except HTTPException as exc:
-            assert exc.status_code == 400
+        except InvalidOperationError as exc:
+            assert exc.code == "INVALID_OPERATION"
 
         test2 = _make_test(state)
         try:
             validate_as_blue_lead(db, test2, blue_lead, "approved", "OK")
             assert False, f"Blue Lead should not validate in {state.value}"
-        except HTTPException as exc:
-            assert exc.status_code == 400
+        except InvalidOperationError as exc:
+            assert exc.code == "INVALID_OPERATION"
 
 
 # ===========================================================================
@@ -536,8 +540,8 @@ def test_cannot_reopen_non_rejected_test(mock_log):
         try:
             reopen_test(db, test, user)
             assert False, f"Should not reopen from {state.value}"
-        except HTTPException as exc:
-            assert exc.status_code == 400
+        except InvalidTransitionError as exc:
+            assert exc.code == "INVALID_TRANSITION"
 
 
 # ---------------------------------------------------------------------------