feat: add configuration, logging, metrics, scheduler and storage foundation

- config: defaults -> JSON file -> NOEMA_* env with validation and redaction
- observability: slog with secret-redacting handler; Prometheus registry with
  the metric set from the plan (events, workspace, memory, LLM, tools, queues)
- scheduler: supervised Group and bounded Pool so no goroutine is unowned
- storage: pgx pool with statement timeout, embedded migration runner
  (advisory lock, checksums, up/down/status), per-test schema helper
- migrations/0001: append-only guard trigger, users, sessions, api tokens,
  recovery codes, audit log, settings
- pkg/ids: UUIDv7 with monotonic counter

internal/observability/log_test.go

@@ -0,0 +1,17 @@
+package observability
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestRedaction(t *testing.T) {
+	var buf bytes.Buffer
+	l := NewLogger(&buf, "info", "json")
+	l.Info("x", "api_key", "sk-123", "Password", "hunter2", "user", "andy")
+	out := buf.String()
+	if strings.Contains(out, "sk-123") || strings.Contains(out, "hunter2") || !strings.Contains(out, "andy") {
+		t.Fatalf("redaction wrong: %s", out)
+	}
+}