refactor: extract DB mixins, middleware handlers, and lifecycle hooks

[Nate-Soul]

What & why

Three structural splits to keep the boilerplate readable as it grows. No behavior change — all endpoints, security headers, and error envelopes are byte-identical (verified by the existing suite + a runtime smoke test).

1. Composable DB mixins (database/mixins.py)

TimestampedBase bundled UUID PK + timestamps + soft delete into one abstract base. Split into three independently-usable mixins — UUIDPrimaryKeyMixin, TimestampMixin, SoftDeleteMixin — with TimestampedBase now composing all three. base.py keeps only the primitives (Base, GUID, UTC helpers). Future models can pick columns à la carte:

class Widget(UUIDPrimaryKeyMixin, TimestampMixin, Base):  # no soft delete

2. CORS + exception handlers out of main.py

• middleware/cors.py → configure_cors(app)
• middleware/error_handler.py → register_exception_handlers(app) (the envelope helper + all four handlers + the slowapi 429 handler)
• main.py is now a thin assembly file.

3. Lifecycle hooks (core/events.py)

Extracted the inline ASGI lifespan into named _startup / _shutdown hooks, now wrapped in try/finally so shutdown (engine dispose) runs even on teardown-after-error. Documented convention for slotting in Redis / queues / model warm-up later as fail-open steps.

Verification

• ruff check . ✅
• mypy app --ignore-missing-imports ✅
• alembic upgrade head ✅ (schema unchanged — Alembic still reads Base.metadata)
• pytest --cov=app --cov-fail-under=70 ✅ — 19 passed, 85% coverage
• Runtime smoke: lifespan startup/shutdown fire, CORS + X-Request-ID + CSP headers present, error envelope intact