[Tech debt] Enforce clean architecture boundaries with fitness tests

Overview

The clean architecture boundaries are stated clearly and repeatedly — in CLAUDE.md, in docs/, and in code comments — but none of them is a test. The unit suite has 4,885 test methods and not one asserts that Application cannot see Persistence, or that a controller cannot take a DbContext.

Every boundary violation currently in the codebase (see the sibling tech-debt tickets) was introduced by someone who had read the rule. Review attention has held the line remarkably well across 10 contributors and ~1,400 commits, but it will not scale further.

Evidence

The only files matching architecture under tests/ are IntegrationTests/Architecture/AzureQueueCutoverGuardTests.cs and UnitTests/Search/SearchCaseCoverageTests.cs — neither asserts a project boundary.

Proposed fix

Add NetArchTest.Rules to Directory.Packages.props and the unit test project, then encode the boundaries section of CLAUDE.md as roughly six assertions:

• Domain has no dependency on any other project.
• Application depends only on Domain.
• Application has no reference to Microsoft.EntityFrameworkCore or Microsoft.AspNetCore.* types.
• Infrastructure has no dependency on Persistence.
• Persistence has no dependency on Infrastructure.
• Web controllers do not depend on IPortalDbContext.

Land this first. The tests will fail immediately, which is the point — they document the current debt and stop it growing while the other tickets are worked.

Acceptance criteria

• NetArchTest.Rules added centrally in src/Directory.Packages.props.
• Six boundary tests exist in the unit test project.
• Any rule that cannot pass yet is [Fact(Skip = "...")] with a link to the ticket that fixes it, rather than deleted.
• The CLAUDE.md boundaries section links to the test file.