feat(db): Postgres schema, migrations and defects repository (T3)

Drizzle schema for projects, defects, push_subscriptions (C8); generated
migration; a defects repository (createDefect / listRecentDefects); a
programmatic migrator; and a db:verify script. section_id is a plain string
referencing in-code board ids, no FK (ADR 0001). Verified against real
Postgres: migration applies, a defect round-trips, /api/health reports db up.

server/db/schema.ts

@@ -1,2 +1,31 @@
-// Drizzle (Postgres) schema — tables are defined in Task 3.
-export {}
+// Drizzle (Postgres) schema (C8).
+// `section_id` is a plain string referencing the in-code board section ids
+// (C1) — no foreign key, because sections live in code, not the DB (ADR 0001).
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core'
+import { randomUUID } from 'node:crypto'
+
+export const projects = pgTable('projects', {
+  id: uuid('id').primaryKey().$defaultFn(randomUUID),
+  name: text('name').notNull().unique(),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export const defects = pgTable('defects', {
+  id: uuid('id').primaryKey().$defaultFn(randomUUID),
+  sectionId: text('section_id').notNull(),
+  projectId: uuid('project_id')
+    .notNull()
+    .references(() => projects.id),
+  verbatim: text('verbatim').notNull(),
+  reporterEmail: text('reporter_email').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export const pushSubscriptions = pgTable('push_subscriptions', {
+  id: uuid('id').primaryKey().$defaultFn(randomUUID),
+  endpoint: text('endpoint').notNull().unique(),
+  p256dh: text('p256dh').notNull(),
+  auth: text('auth').notNull(),
+  reporterEmail: text('reporter_email'),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+})