Add static quality gates (architecture, complexity, coverage)

[henokteixeira]

Summary

Adds static quality gates enforced on every PR and runnable locally via make quality. This is config/CI only — no business logic (app/**) changed. Thresholds are calibrated to the current baseline (Phase 0, green now) and ratchet over time (see obt/.claude/quality-gates-plan.md). Policy is documented in CLAUDE.md section 10.

• Architecture / dependencies (import-linter): layers api > services > models > db > core; routers must not import ORM (app.db) directly; services must not import fastapi or app.inngest. Cross-layer cycles are caught by the layers contract. Current violations are baselined via ignore_imports (43 api→db, 6 layer, 1 fastapi, 3 inngest); new violations fail the PR.
• Complexity / size (ruff): C901 max-complexity = 22, PLR0915 max-statements = 54.
• File length (scripts/check_module_size.py): 470 lines, exempting *_default_prompts.py so prompt text lives in dedicated files but embedding large prompts in code files still trips the gate.
• Coverage (pytest-cov): fail_under = 66 (current 68%), reports to reports/quality/.
• Mutation (cosmic-ray, scope app/utils): nightly, non-blocking.

Test plan

• make quality passes locally (static + coverage 67.76% ≥ 66%, 655 tests).
• CI Lint green (ruff, mypy, import-linter, module-size).
• CI Test green (coverage gate).
• Gates block new violations — verified locally that each of these fails its gate and reverting restores green: a new app.api → app.db import, a core → api layer inversion, a >470-line non-prompt file, and coverage below the threshold.