Database connector: Microsoft SQL Server #97

What

Let Steward keep its own records (users, sessions, the Decionis workspace connection, signal sources, decisions, reviews, activities) on Microsoft SQL Server, selected by STEWARD_DATABASE_URL=mssql://…. Plan: docs/Persistence.md, decisions P1 (TypeORM), P2 (all drivers shipped in the image) and workstream DB6.

The embedded database (SQLite) lands first and defines the portable schema and the migration style; this issue makes the same migrations and the same repositories pass on Microsoft SQL Server.

Scope

• Add the driver mssql (MIT) as a production dependency; it must pass pnpm licenses:check.
• Wire the dialect in infra/persistence/StewardDataSource.ts from the URL scheme, with TLS and pool options from URL parameters.
• Run every migration under infra/persistence/migrations/ on Microsoft SQL Server and fix any non-portable column type or index in the shared migration, never with dialect-specific SQL outside the dialect adapter.
• Run the persistence test suite against a Microsoft SQL Server service container in CI: a nightly job (and on demand) rather than on every pull request.
• A section in docs/Docker.md: the URL shape, a compose example, what the operator must provision, and the note that the database licence is the operator's.
• Ship the driver in the image and confirm the image starts against Microsoft SQL Server (docker run … -e STEWARD_DATABASE_URL=mssql://…).
• Verify nvarchar for text columns and bit for booleans, and that encrypt and trustServerCertificate travel as URL parameters.

Done when

• Migrations apply from empty and re-apply as a no-op on Microsoft SQL Server; STEWARD_DATABASE_MIGRATE=off with a pending migration refuses to serve.
• The persistence tests pass on Microsoft SQL Server in the nightly matrix.
• GET /api/health reports the dialect and the migration state.
• The Docker guide and public/llms-full.txt name Microsoft SQL Server as supported.

How to pick this up

• Comment on this issue so nobody else starts it, then branch from master with one branch per issue; the bot opens the pull request when you push.
• Follow CONTRIBUTING.md: pnpm verify green, every commit signed off with -s (DCO), no telemetry, no dependency outside the license policy in scripts/CheckLicensePolicy.mjs.
• Fixtures and samples follow the demo conventions: organisations from the NATO alphabet, people surnamed Example, references shaped CRM-DEMO-000n, no real host, email, phone or URL. The tests enforce it.
• Update the documents that make a claim about what you changed in the same pull request: README, the Docker guide, ThreatModel, and the discovery files public/llms*.txt (with pnpm discovery).