Introduces `@openstatus/services` as the future single write path for business operations. PR 0 is scaffolding only — no domain logic, no caller changes, safe to merge standalone. Contents: - ServiceContext with 5-variant Actor union (user/apiKey/slack/system/webhook) - DB / DrizzleClient / DrizzleTx types and withTransaction helper (reuses caller's tx if threaded; opens fresh otherwise; never nests) - ServiceError hierarchy (NotFound/Forbidden/Conflict/Validation/LimitExceeded/…) - emitAudit log-only stub (v1) with a test-buffer hook for assertion - assertWithinLimit scaffold (refetches workspace inside tx; per-domain counters land with each domain migration) - types.ts re-export point so surface files have a legal import path once the Biome @openstatus/db ban lands - Test harness: loadSeededWorkspace, makeSlackCtx / makeApiKeyCtx / makeUserCtx / makeSystemCtx, expectAuditRow - withTransaction unit tests Adds `SQLiteTransaction` to `@openstatus/db` re-exports so services can identity-check via drizzle's `is()` helper without declaring drizzle-orm directly (keeps all drizzle types on one resolution path under pnpm). Biome override is intentionally deferred to PR 1 where the first real file scope (status-report) lands. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>