Add ASP.NET Core habit check-ins with repeat-safe dates

[sdairs]

Users create habits, record a completion for an explicit calendar date, undo it and archive without losing history. A server token mapping derives ownership; every habit read/write is account-scoped. A unique habit/date index makes completion repeat-safe, while check-in, undo and archive share a parent row lock so their state checks and writes stay ordered.

ASP.NET Core minimal API, EF Core and Npgsql use verified Cloud TLS, pinned SDK/package versions and NuGet lockfiles. EF migrations run explicitly with a separate schema-owner credential; normal startup does not run DDL. The README shows Cloud creation, role/bootstrap/migration/grants/seed, HTTP usage and cleanup. CI builds and runs account/date contract tests without Cloud secrets.

Validation on 2 October 2026, native Ubuntu VM, .NET SDK 10.0.401 / ASP.NET Core 10.0.12, EF 10.0.12, Npgsql/provider 10.0.3, Postgres 18.6 in ClickHouse Cloud:

• Locked restore/build succeeded with 0 warnings and 0 errors;3 contract tests passed.
• Empty roles/schema → bootstrap → EF migration → grants/seed, no manual grants or database CREATE; repeated migration/seed and pending-model check passed.
• 6 Cloud tests passed: independent duplicate writers produce one success and one named 23505; held parent locks force both archive/check-in orders with actual blocked-session observation; real rollback; runtime permission denials/TLS positive; wrong-CA certificate failure with positive same-endpoint control.
• HTTP suite passed ownership, invalid date/name/NUL/JSON/body bounds,8 concurrent duplicate check-ins with one stored ID,4 archive/check-in races, archived replay/undo, ordered bounded monthly history and production-process restart persistence.
• All 27 native application files matched staged Git blobs by SHA-256 before commit.

Calendar contract is explicit DateOnly,2000–2100, no timezone/streak behavior. Monthly history is capped 31; habit list newest 100, no pagination. Tokens and shared database role assume trusted application infrastructure, without row-level security or token issuance. Article and private evidence remain outside this PR.