fix(compose): make full stack boot — quote reserved "window" column + ship pydantic[email]

[beenuar]

Summary

The docker compose up — full stack (Compose Smoke) CI job had been chronically red, meaning the product could not actually boot end-to-end. Root-caused and fixed two independent, product-breaking bugs. The full-stack smoke job now passes (first green in a long time).

Bug 1 — Postgres init crash (aisoc-postgres exited (3))

services/api/migrations/041_attack_chains.sql used window (a reserved keyword in Postgres) as an unquoted column name. Postgres refused to run the migration on container init:

ERROR: syntax error at or near "window"

Because migrations are mounted into /docker-entrypoint-initdb.d, this killed the DB container on startup and took the whole stack down.

Fix: quote the identifier as "window" everywhere it is used:

• column definition, CHECK constraint, and UNIQUE constraint in the migration
• the raw INSERT ... ON CONFLICT in services/api/app/api/v1/endpoints/attack_chain.py

Bug 2 — API container crash on import (email-validator is not installed)

app/api/v1/endpoints/auth.py uses Pydantic's EmailStr, which requires the optional email-validator package. pydantic was declared without the [email] extra, so neither the Poetry install nor the Dockerfile pip-fallback shipped it. The aisoc-api container crashed on import.

Fix:

• services/api/pyproject.toml: pydantic = { version = ">=2.7,<2.14", extras = ["email"] }
• services/api/Dockerfile: pip fallback now installs pydantic[email]>=2.7,<2.14

Test plan

• docker compose up — full stack CI job passes (5m34s) — previously failing
• All other CI checks green (Python/Go/TS lint, type-check, tests, builds, CodeQL, OpenAPI verify, compose validate)
• Local: email_validator importable after pyproject.toml change
• Local: Postgres init runs 041_attack_chains.sql without syntax error

Note: the security-audit check remains red — this is the pre-existing, accepted failure surfacing transitive-dependency CVEs (langchain/cryptography/starlette/idna + pnpm transitive deps) unrelated to this change. Tracked separately.