feat: Phase 1 - Data models and migrations (T-004 to T-009)

Implements all database models for the Aegis platform with full
Alembic migration support.

Models created:
- User: Authentication with role-based access control
- Technique: MITRE ATT&CK techniques with coverage status tracking
- Test: Security tests with validation workflow (draft/review/validated)
- Evidence: File metadata for test evidence (stored in MinIO)
- IntelItem: Threat intelligence items linked to techniques
- AuditLog: System-wide audit trail with JSONB details

Enumerations:
- TechniqueStatus: not_evaluated, in_progress, validated, partial, etc.
- TestState: draft, in_review, validated, rejected
- TestResult: detected, not_detected, partially_detected

Services:
- audit_service.py: log_action() helper for audit logging

All models include proper foreign key relationships and PostgreSQL
enum types are managed correctly in migrations (create/drop).

README.md

@@ -85,10 +85,33 @@ Aegis/
 │       ├── __init__.py
 │       ├── main.py         # FastAPI application entry point
 │       ├── config.py       # Application settings
-│       └── database.py     # SQLAlchemy configuration
+│       ├── database.py     # SQLAlchemy configuration
+│       ├── models/         # SQLAlchemy models
+│       │   ├── user.py     # User authentication model
+│       │   ├── technique.py # MITRE ATT&CK techniques
+│       │   ├── test.py     # Security tests
+│       │   ├── evidence.py # Test evidence files
+│       │   ├── intel.py    # Threat intelligence items
+│       │   ├── audit.py    # Audit logging
+│       │   └── enums.py    # Shared enumerations
+│       └── services/       # Business logic services
+│           └── audit_service.py
 └── frontend/               # React frontend (coming soon)
 ```
 
+## Database Schema
+
+The platform uses the following data models:
+
+| Table | Description |
+|-------|-------------|
+| `users` | User accounts with role-based access |
+| `techniques` | MITRE ATT&CK techniques with coverage status |
+| `tests` | Security tests validating technique coverage |
+| `evidences` | File evidence attached to tests (stored in MinIO) |
+| `intel_items` | Threat intelligence items linked to techniques |
+| `audit_logs` | System-wide audit trail for all actions |
+
 ## Configuration
 
 The application can be configured via environment variables: