feat: scaffold services/grader to the tech-stack standard (#293)

[ckrough]

Closes #293

Greenfield FastAPI service at services/grader/, scaffolded to the tech-stack standard following the services/petdata/ pattern. No domain logic (#294), data layer (#296), or auth (#298).

• uv-managed src/grader/ layout, Python 3.14, hatchling.
• Config via pydantic-settings, env prefix GRADER_.
• GET /health and GET /llms.txt (via fast-llms-txt).
• structlog single-line JSON logging; OpenTelemetry API only (no SDK, no exporters, no opentelemetry-instrumentation-*).
• Two-stage Dockerfile (non-root user) and docker-compose.yml on host port 8003 (8001 retriever, 8002 petdata are taken).
• CLAUDE.md with build/test commands.

Every file in this PR is under services/grader/; nothing outside the issue's stated scope was touched.

Pipeline phases

	Phase	Note
🟡	Plan / design triage	complexity 3: one Opus design pass run; its report was truncated by the harness, so the lead authored the adopted plan from services/petdata/ directly
🟢	Implement	implementer ran, tests written first
🟡	Test-validation	1 blocking + 5 advisory findings; advisories 2-6 remediated (structural YAML compose assertions, route/version assertions, structlog state restore, Dockerfile port cross-check). The blocking finding (grader absent from CI and the bound gates) was adjudicated out of T1 scope and split out as #316
🟢	Review-gate	APPROVE (1 cycle), plus a second APPROVE on the /simplify delta
🟡	Simplify	applied 10 cleanups (dead settings, a fragile route walker, redundant tests, unused pytest-asyncio, Dockerfile layer/port fixes); delta re-reviewed APPROVE
🟢	Gates	configured test + lint both exit 0
🟡	Security review	no blocking findings; 5 advisories accepted (see below)
🟢	PR opened	non-draft, closes #293

Test results

Repo-wide configured gates (.daedalus/config.json), both exit 0:

• lint — retriever (ruff check, ruff format --check, mypy --strict) + petdata (ruff, mypy, bandit) + stacker (npm run check): exit 0
• test — retriever pytest (385 passed, 10 deselected) + stacker npm run build (built in 2.40s / 5.58s): exit 0

Grader's own gates, run from services/grader/ (grader is not yet in the bound commands: that is #316):

• uv run ruff check src/ tests/ — exit 0
• uv run ruff format --check src/ tests/ — exit 0
• uvx bandit -r src/ -q — exit 0
• uv run mypy src/ — exit 0 (strict)
• uv run pytest — 10 passed

Acceptance criteria were also graded against a real container, not just proxies. docker build + docker run -p 8003:8000:

$ curl -fsS http://localhost:8003/health
{"status":"healthy","version":"0.1.0"}
$ curl -fsS http://localhost:8003/llms.txt | head -3
# Profile Grader

## Schema Definitions

Eval scores

No evals configured in this repo.

Follow-ups

• Wire services/grader into CI and the local stack #316 — wire grader into .github/workflows/ci.yml, the bound daedalus gates, and the one-command local stack (Makefile + docs/local-development.md).
• Security advisories accepted, none blocking: add a validator rejecting "*" in GRADER_ALLOWED_ORIGINS (latent until auth lands in T6: Port the API routes with auth, tightened CORS, typed responses #298); uvicorn/stdlib startup and access logs still render as plain text rather than JSON, so only application logs are single-line JSON today; Dockerfile pulls ghcr.io/astral-sh/uv:latest unpinned; compose publishes 8003 on 0.0.0.0 rather than 127.0.0.1.