feat(V1-API): implement TREX-Basic consumer API contract with encryption and persistence

- Add V1 API endpoints: assets, ledger, user-info
- Implement Fernet-based credential payload encryption (req-010)
- Extend health response schema with runtime info (req-004)
- Add service token runtime ID issuance (req-005)
- Implement database schema migration for V1 API (req-009)
- Add comprehensive test coverage for V1 endpoints
- Update SRS with 10 new requirements (REQ-004 through REQ-011)
- Create batch planning, design, and verification for BAT-001
- Integrate review-discovery StagePilot skill
- Update documentation indices and baseline specs

tests/test_auth.py

@@ -98,6 +98,7 @@ class _AuthRepo:
         permission: str,
         token_type: str,
         expires_at: datetime | None = None,
+        runtime_id: str | None = None,
     ) -> AuthToken:
         token = AuthToken(
             id=f"token-{self._seq}",
@@ -108,6 +109,7 @@ class _AuthRepo:
             token_type=token_type,
             expires_at=expires_at,
             created_at=datetime.now(timezone.utc),
+            runtime_id=runtime_id,
         )
         self._seq += 1
         self.tokens[token.id] = token