[Tech debt] Decide the admin/dev tooling split, and two smaller boundary leaks

Overview

Of the ten largest controllers, seven are admin or development tooling: search analytics, rules admin, page-tree admin, content staging, test data, queue admin and observability. TestDataController (617 lines) and DevPipelineController ship in the same assembly as the pages schools use, gated only by configuration and environment checks.

This is not urgent and the current arrangement is defensible — but it should be a decision rather than a drift, because admin and citizen-facing code are currently held to visibly different quality bars in the same deployable.

Two related smells of the same size are bundled here rather than given their own tickets.

Evidence

• 62 controllers, 10,972 lines total; admin/dev controllers account for roughly 4,300 of them.
• SearchAnalyticsController 806, AdminRulesController 722, PageTreeAdminController 655, TestDataController 617, ContentStagingController 589, ObservabilityController 488, QueueAdminController 391.

Related, smaller items:

1. Application carries an EF Core package reference used by exactly one file — Application/Search/SiteSearchService.cs is the only using Microsoft.EntityFrameworkCore in the project. That single reference is all that stands between the team and the next EF query written in the wrong layer.
2. CancellationToken propagation is good but not yet a rule — roughly 570 of 640 async signatures across src/ take one.
3. Test project naming mismatch — the directory tests/DfE.CheckPerformanceData.UnitTests/ contains DfE.CheckPerformanceData.Application.UnitTests.csproj.

Proposed fix

Decide explicitly: either keep the mixed assembly and hold admin code to the same review bar as public pages, or plan a separate admin host. Either is fine; drifting is not.

Independently of that decision:

• Move the one EF query behind a repository interface and drop Microsoft.EntityFrameworkCore from Application.csproj.
• Rename the unit test project file to match its directory.

Acceptance criteria

• A direction on the admin split is agreed and recorded (ADR or a note in docs/architecture/).
• Application.csproj no longer references Microsoft.EntityFrameworkCore.
• Unit test project file name matches its directory.