server: add SQLAlchemy + Alembic dependencies and skeleton

[nissessenap]

Closes #304. Part of the #257 epic (Phase 1, step 1) — passive
infrastructure only; no migrations, no runtime code imports either
library, app.py / store.py / tables.py untouched.

What's in

• server/backend/pyproject.toml: sqlalchemy>=2.0.49,<2.1 and
  alembic>=1.18.4,<2 added to runtime deps.
• server/backend/uv.lock: regenerated. Diff vs main is only the 5
  net-new packages (alembic, mako, sqlalchemy, greenlet, markupsafe);
  no pre-existing entry changed.
• server/backend/src/cq_server/db_url.py: resolve_database_url()
  helper centralising the precedence CQ_DATABASE_URL →
  CQ_DB_PATH (wrapped as sqlite:///…) → default /data/cq.db.
  No runtime callers yet; Wire CQ_DATABASE_URL and store factory #309 will wire it into the store factory.
• server/backend/alembic.ini + alembic/env.py +
  alembic/script.py.mako + empty versions/: minimal skeleton.
  env.py sets render_as_batch=True in both online and offline
  modes so future migrations run cleanly on SQLite;
  target_metadata=None until Baseline Alembic migration + stamp-on-startup logic #305 adds the baseline.
• server/backend/README.md: short note explaining the wiring is
  staged-but-unused and documenting the URL precedence.
• tests/test_db_url.py: four TDD cases covering explicit URL wins,
  CQ_DB_PATH wrapping, the /data/cq.db default, and empty-string
  CQ_DATABASE_URL falling through to CQ_DB_PATH (container
  orchestrators sometimes pass empty env vars).

What's intentionally out

Deferred to the next Phase 1 children per #257's dep graph:

• Baseline migration + stamp-on-startup logic → Baseline Alembic migration + stamp-on-startup logic #305.
• Async Store protocol → Define async Store protocol #306.
• Shared SQLAlchemy Core query helpers → Shared SQLAlchemy Core query helpers for portable queries #307.
• SqliteStore via the protocol → Implement SqliteStore against Store protocol via Core helpers #308.
• Runtime CQ_DATABASE_URL wiring + store factory → Wire CQ_DATABASE_URL and store factory #309.
• Removing ad-hoc _ensure_* DDL → Remove ad-hoc _ensure_* DDL now that Alembic owns the schema #310.
• Full env-var documentation → Document CQ_DATABASE_URL in deployment / configuration docs #319.

Known follow-up

alembic/env.py routes the resolved URL through
config.set_main_option("sqlalchemy.url", …), which internally uses
ConfigParser — % characters are treated as interpolation tokens.
Harmless today (SQLite paths only), but a Postgres URL containing a
URL-encoded password (p%40ss) would blow up. An in-line comment
flags this for #309 to resolve — either by escaping at the boundary
or, cleaner, by dropping the ConfigParser round-trip and passing
the URL straight to context.configure(url=…) / create_engine(…).

Test plan

• cd server/backend && CQ_DB_PATH=/tmp/cq.db uv run alembic current
  exits 0 with no revision printed (acceptance criterion from Add SQLAlchemy + Alembic dependencies and Alembic skeleton #304).
• uv run pytest → 194 passed.
• uv run pre-commit run --all-files clean.
• alembic check fails with the expected "no MetaData" message —
  correct, since target_metadata=None until Baseline Alembic migration + stamp-on-startup logic #305.
• No change in server runtime behaviour; app.py still calls
  _ensure_schema() and opens raw sqlite3 connections exactly as on
  main.

🤖 Generated with Claude Code