closes #263
…alid key rotation windows

Summary

Adds DB-level CHECK constraints on three monetary/temporal fields that previously lacked schema-level guards:

• Claim.amount > 0
• BalanceLedger.amount != 0
• ApiKey.revokedAt >= createdAt (passes when revokedAt IS NULL)

Existing application logic already prevents violations, but no DB-level guarantee existed.

Closes #263

Testing

• Created a hand-written Prisma migration at app/backend/prisma/migrations/20260718000000_add_check_constraints/
• Applied baseline + migration against an in-memory SQLite database using node:sqlite
• Verified all 6 test cases:

cd app/backend

# Schema validation (DATABASE_URL must be a valid Postgres URL):
DATABASE_URL="postgresql://localhost:5432/test" npx prisma validate

# Apply migration on local SQLite dev db:
npx prisma migrate deploy

# Or generate a new migration via Prisma Migrate:
npx prisma migrate dev --name add_check_constraints

Test matrix (all pass):

Screenshots

N/A

Checklist

• Tests added or updated for new/changed behavior
• Existing tests pass
• No secrets, keys, or seed phrases committed
• Follows the coding conventions in the relevant service README
• PR is focused on a single concern