feat(01-01): Drizzle schema + DB client + /health slice (GREEN)

- src/db/schema.ts: users, memberCredentials, calendars, calendarEvents tables
  - users: composite unique on oidc_iss+oidc_sub (D-10 identity)
  - calendar_events: separate dtstart_utc (TIMESTAMP) and dtstart_date (DATE) + allDay boolean (D-13)
- src/db/client.ts: drizzle(mysql2 pool) singleton export `db`
- drizzle.config.ts: dialect mysql, schema → migrations, dbCredentials from env
- src/routes/health.ts: GET / with real SELECT 1 DB round-trip, 200 or 503
- src/index.ts: Hono app with /health mounted before auth, serveStatic for PWA
- tests/health.test.ts: 2 tests pass (mocked DB); TDD GREEN gate
- apps/pwa/src/App.tsx: React shell fetching /health via TanStack Query

apps/api/src/index.ts

@@ -0,0 +1,21 @@
+import { serve } from '@hono/node-server'
+import { serveStatic } from '@hono/node-server/serve-static'
+import { Hono } from 'hono'
+import { healthRouter } from './routes/health.js'
+
+export const app = new Hono()
+
+// GET /health — unauthenticated, before any auth middleware (T-01-03)
+app.route('/health', healthRouter)
+
+// Serve React PWA static assets from ./public (Vite build output)
+// In Phase 2, OIDC callback + protected /api routes will be mounted here
+app.use('/assets/*', serveStatic({ root: './public' }))
+app.get('*', serveStatic({ path: './public/index.html' }))
+
+// Only start the HTTP server when this module is run directly (not imported in tests)
+if (process.argv[1] && import.meta.url.endsWith(process.argv[1].replace(/^.*\//, ''))) {
+  serve({ fetch: app.fetch, port: 3000 }, (info) => {
+    console.log(`FamilySync API running on http://localhost:${info.port}`)
+  })
+}