security: add missing CHECK constraints to schema.sql

[stackbilt-admin]

Context

Internal AEGIS shipped missing CHECK constraints in v1.81.0 (aegis#398). OSS variant has unconstrained enum TEXT columns — invalid values can be written to the database without error.

Missing Constraints

codebeast_findings (all 4 enum columns unprotected)

severity TEXT NOT NULL
  CHECK (severity IN ('HIGH', 'MID', 'LOW', 'INFO')),
category TEXT NOT NULL DEFAULT 'LOGIC'
  CHECK (category IN ('SECURITY', 'LOGIC', 'STYLE', 'DEPENDENCY', 'BOUNDARY')),
priority TEXT NOT NULL DEFAULT 'low'
  CHECK (priority IN ('high', 'medium', 'low')),
status TEXT NOT NULL DEFAULT 'open'
  CHECK (status IN ('open', 'resolved')),

episodic_memory

outcome TEXT NOT NULL DEFAULT 'success'
  CHECK (outcome IN ('success', 'failure')),

Fix

Update web/schema.sql with the CHECK constraints above. Existing data should already comply — these values are documented in comments but not enforced.

Design Philosophy Alignment

• Pillar 1: Schema Over Code — the schema IS the product
• Pillar 5: Zero-Trust Governance — defense in depth at the DB layer
• Parity with internal AEGIS v1.81.0

[stackbilt-admin]

Closing — the dependency model (aegis-oss#18) makes manual porting obsolete. Once internal AEGIS consumes @stackbilt/aegis-core as a dependency, this feature will flow downstream automatically because the core IS the production code.