v0.11.0 — SQLite persistence layer (SeismoDb)

sfm/database.py (new)
- SeismoDb class: three tables keyed by unit serial number
  - ach_sessions: one row per ACH call-home
  - events: one row per triggered event, deduped by (serial, waveform_key)
  - monitor_log: one row per monitoring interval, deduped by (serial, waveform_key)
- WAL mode, per-request connections, silent dedup via UNIQUE constraint
- Query helpers: query_events(), query_monitor_log(), get_sessions(), query_units()
- false_trigger flag on events for future review UI / report filtering

bridges/ach_server.py
- Import SeismoDb; create shared instance at startup pointed at
  bridges/captures/seismo_relay.db
- After each call-home: insert_events() + insert_monitor_log() + insert_ach_session()
- DB failures logged as warnings, never abort the session

sfm/server.py
- Import SeismoDb; lazy singleton via _get_db()
- New DB read endpoints: GET /db/units, /db/events, /db/monitor_log, /db/sessions
- PATCH /db/events/{id}/false_trigger for manual review flagging

CLAUDE.md / CHANGELOG.md
- Document DB schema, SFM DB endpoints, architecture decision (unit-keyed only)
- Version bump to v0.11.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -416,6 +416,8 @@ for 0x10 records).
 
 ## SFM REST API (sfm/server.py)
 
+### Live device endpoints (connect to device per-request)
+
 ```
 GET  /device/info?port=COM5                              ← serial
 GET  /device/info?host=1.2.3.4&tcp_port=9034            ← cellular
@@ -428,6 +430,19 @@ POST /device/monitor/stop?host=1.2.3.4&tcp_port=9034    ← stop recording
 
 Server retries once on `ProtocolError` for TCP connections (handles cold-boot timing).
 
+### DB read endpoints (query seismo_relay.db written by ach_server.py)
+
+```
+GET  /db/units                                           ← all known serials + summary stats
+GET  /db/events?serial=BE11529&from_dt=&to_dt=&limit=   ← triggered events, newest first
+GET  /db/monitor_log?serial=BE11529&from_dt=&to_dt=     ← monitoring intervals, newest first
+GET  /db/sessions?serial=BE11529&limit=50               ← ACH call-home sessions, newest first
+PATCH /db/events/{id}/false_trigger?value=true          ← flag/unflag false triggers
+```
+
+DB file: `bridges/captures/seismo_relay.db` (default; override with `--db-path` at startup).
+All DB endpoints are read-only except `PATCH /db/events/{id}/false_trigger`.
+
 ---
 
 ## Key wire captures (reference material)