Bootstrap: feedback proof point + scaffold for sessions/traces

[rdwj]

Summary

Initial bootstrap of the cross-agent platform service. Implementation companion to agent-template#112 (architecture decision: Option 4, remote-store adapter with sibling platform service).

What's done in this bootstrap commit

• FastAPI service skeleton (src/fipsagents_platform/) with /healthz, /readyz.
• Feedback proof point: POST /v1/feedback, GET /v1/feedback, GET /v1/feedback/{id}, PATCH /v1/feedback/{id}, GET /v1/feedback/stats.
• Reuses fipsagents.server.feedback.FeedbackStore (SQLite + Postgres backends from agent-template) — no parallel persistence implementation.
• Bearer-token auth with none and keycloak modes (validates against the same realm as the gateway).
• Helm chart (UBI9 base image, ConfigMap, optional PVC for SQLite, optional OpenShift Route).
• pytest suite: 13/13 passing end-to-end against a real SQLite store.

What this issue tracks (the next slice of work)

• Sessions proof point. Wire SessionStore ABC over REST. Endpoints: POST /v1/sessions, GET /v1/sessions/{id}, DELETE /v1/sessions/{id}. Currently 501.
• Traces proof point. Wire TraceStore ABC over REST. Endpoints: GET /v1/traces, GET /v1/traces/{id}. Currently 501.
• Database migrations. With three tables sharing one Postgres pool, decide whether to roll our own CREATE TABLE IF NOT EXISTS (mirroring fipsagents) or adopt a tool (alembic). Lean toward minimal — fipsagents already does the former.
• Image publishing. Tag-driven build + push to quay.io / ghcr.io. Mirror agent-template's pattern.
• Helm chart publishing. TBD whether we publish to a Helm registry or expect users to clone.
• API stability policy. Per the architecture doc tradeoffs section: schema-as-contract moves from raw Postgres to HTTP. Document deprecation rules before any external consumer.

Companion issues

• agent-template#114 — HttpFeedbackStore / HttpSessionStore / HttpTraceStore on the agent side
• gateway-template#30 — gateway routing mode

Out of scope

Per the architecture doc:

• Cross-tenant auth boundary — punt until multi-tenant is in scope.
• Cross-agent session continuity — protocol question, not a storage question.
• OTEL trace export inside the platform — already partially solved by OTELTraceStore in fipsagents; can adopt later without a topology change.

Size

L (this issue is the umbrella; sessions and traces will likely split into their own subtasks)