refactor: move tables into app/core/db

[dimslaev]

Step 2 of the backend architecture plan.

What moved

• Every table and its stored enums now lives in app/core/db/, one module per table: publisher.py, article.py, tag.py, story.py, ledger.py, run.py, user.py, like.py, subscriber.py, event.py. UserBase, PublisherBase and ArticleBase moved with their tables.
• Non-table shapes stay in each domain's models.py. app/newsletter/models.py and pipeline/models.py held only tables, so they are gone.
• record_reject, CONTENT_CAP and CANDIDATE_CAP moved into ledger.py (was pipeline/rejects.py). record_reject now takes a LedgerItem TypedDict, so core does not import pipeline.types. The pipeline's Candidate still fits it.
• kind_from_url moved into article.py (was pipeline/url_kind.py). like_counts_subquery moved into like.py (was in catalog/articles.py).
• One engine: app/core/db/engine.py holds engine and get_session. app/core/db.py and pipeline/db.py are gone. deps.SessionDep uses get_session.
• app/core/db/__init__.py imports every table module, so migrations/env.py imports app.core.db and needs no per-domain line.
• Migrations moved from app/alembic to backend/migrations. The alembic config is [tool.alembic] in backend/pyproject.toml. alembic.ini is gone, and env.py sets up its own logging.
• mypy and ruff excludes now name migrations. docs/backend.md points at the new paths. tests/pipeline/test_rejects.py moved to tests/core/test_ledger.py.

Behaviour changes

• The pipeline (pipeline.run, pipeline.report, find_missing_tags) now connects through app.core.settings, as ADR 7's follow-up in the plan says. It needs PROJECT_NAME, POSTGRES_SERVER and POSTGRES_USER. The box already feeds the same .env to every unit.
• The comments in deploy/agentique-pipeline.service and deploy/agentique-report.service changed. ExecStart did not change, so reinstalling the units is optional. Copy them when convenient.
• prestart.sh still runs alembic upgrade head from backend/, which now reads pyproject.toml.

Bug fixes

fix: percent-encode database credentials in the dsn

PostgresDsn.build does not escape the user or password. A password with @, / or # produced a broken URL. The old pipeline engine quoted them, so merging the engines would have broken it. Both SQLALCHEMY_DATABASE_URI and MCP_DATABASE_URI now quote the user and password. Tests are in tests/core/test_settings.py.

fix: declare the indexes and column types the migrations built

alembic check failed on the base branch. The models were missing the three article indexes (score, published_at, the hnsw embedding index) and pipeline_run.publishers. They also declared VARCHAR, JSON or naive timestamps where the migrations built TEXT, JSONB and timestamptz (newsletter_subscriber, scored_url.url/created_at, pipeline_run.sources). The models now match the database, so no migration is needed.

Tests added

• tests/core/test_db.py runs alembic's compare_metadata against the migrated test db, so CI now fails on schema drift. It also checks that every table lives in app.core.db, that the engine logs in with the settings credentials, that the request session closes afterwards, and that the routes and the pipeline share one engine.
• tests/core/test_ledger.py adds Postgres-backed tests. A missing detail is stored as SQL NULL. Recording a URL again replaces its row. NUL bytes and an unparsable date still commit.

How I verified

• On a local Postgres 16 with pgvector, alembic upgrade head on an empty db and then alembic check both pass. alembic check also passes on the prestart-migrated db. alembic revision --autogenerate produces an empty revision.
• pytest: 603 passed. /search fails locally because the HF model download is blocked here. It passes in CI.
• ruff check and format, mypy and ty as CI runs them, and cd backend && mypy app/core (strict, 0 errors) all pass. Strict mypy over app scripts reports 126 errors, which was 127 before. The banned-names hook passes.
• typos only flags .claude/skills/curate/regression.md, which was already flagged before this PR.
• scripts/generate-client.sh leaves frontend/src/client unchanged, and the OpenAPI JSON is identical to the base branch.

---

Generated by Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.