Enforce numeric Alembic revisions, add OneShot integration story coverage, and package API/Web containers in CI

[Copilot]

This PR addresses three gaps: migration ordering stability, missing full-story module integration coverage, and missing separate API/Web container packaging in CI. It migrates Alembic to numeric revision IDs, adds end-to-end OneShot extraction integration tests, and adds matrix-based container builds for both services.

• Alembic: numeric revision convention

  • Replaced hash-style revision naming with numeric chain:
    • 0000_base.py (base marker)
    • 0001_add_timestamps.py (timestamps migration)
  • Updated revision metadata (revision, down_revision) to enforce sortable numeric chronology.
  • Removed the prior non-numeric revision file.

• Integration coverage: full OneShot extraction user story

  • Added api/tests/test_oneshot_integration.py to validate the complete module flow:
    • admin issues token
    • one-shot upload succeeds once and rejects replay
    • admin audit endpoints return token/file records with expected fields
    • admin download returns attachment with original filename
    • missing disk file and missing DB metadata both return 404
  • Kept focused security/route tests in test_oneshot.py and moved full-story coverage into dedicated integration test file.

• CI packaging: separate API and Web containers

  • Added api/Dockerfile and web/Dockerfile.
  • Extended .github/workflows/ci.yml with container-packaging matrix job to build:
    • oneshot/api:ci-<sha>
    • oneshot/web:ci-<sha>
  • Added explicit least-privilege workflow permissions (contents: read) at workflow scope.

container-packaging:
  strategy:
    matrix:
      include:
        - name: api
          context: ./api
          dockerfile: ./api/Dockerfile
        - name: web
          context: ./web
          dockerfile: ./web/Dockerfile