Phase 0 milestone 0.9 (code): close plan §6/§7 control gaps

Before flipping control-mapping rows, wire the Phase 0 promises that had
no code behind them yet:

- SI-11 / C.5.7.43: app-wide exception handler returns
  {"error":"internal_error","request_id":...} and the X-Request-ID header.
  Logs exception type + stack frames, not the message — driver errors
  echo bound parameters and key values. Engine set to hide_parameters.
- AU-11 / SI-12 (plan §7 risk): create_app refuses to start if any
  mapped table lacks a retention policy.
- CM-3: migrations/IMMUTABLE.sha256 pins every merged revision; a test
  fails on any edit or on an unpinned new revision.
- migrations/env.py: fileConfig(disable_existing_loggers=False) so
  in-process Alembic (the drift test) doesn't silence app loggers.

163 tests passing; ruff, mypy, bandit, gitleaks clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ypms/db.py

@@ -19,7 +19,10 @@ _SessionLocal: sessionmaker[Session] | None = None
 def engine() -> Engine:
     global _engine
     if _engine is None:
-        _engine = create_engine(get_settings().database_url, pool_pre_ping=True, future=True)
+        # hide_parameters: keep bound values (PII) out of exception text and logs.
+        _engine = create_engine(
+            get_settings().database_url, pool_pre_ping=True, future=True, hide_parameters=True
+        )
     return _engine