Clean architecture audit fixes: align declared and actual architecture

[MartinKalema]

Summary

An Uncle Bob-perspective audit found the runtime dependency rule held perfectly (zero framework imports inward of infrastructure, mechanically verified) — but the type layer told a different story: annotations violated the rule, most ports had no dependents, and dead machinery misled readers. This PR makes the declared architecture and the actual architecture the same thing, and adds the enforcement that keeps them that way.

Dependency Rule

• CQRS query ports move to the application layer (application/query_handlers/interfaces.py) — they serve views and return application read models, so the audit's only true inward-ring violation (domain importing BookReadModel) disappears. Write-side ports stay in the domain.
• All 17 handler annotations re-pointed from concrete adapters to ports (ILoanUnitOfWork, ICache, query ports); 8 phantom imports of non-existent names fixed
• sqlalchemy leaves presentation: IntegrityError on the unique-active-loan index is translated to BookNotAvailableException inside the loan unit of work
• Health routes decoupled: PostgreSQL.ping(), circuit-breaker registry provided by the container

Boundary contracts

• Read models consolidated (each of PatronReadModel/LoanReadModel was defined twice); patron/loan query repositories now return typed read models instead of raw dicts
• ICache protocol matches the adapter's real async surface

Main component

• api/main.py is now a create_app() factory (uvicorn --factory): importing the module performs no I/O, so the non-e2e suite runs with zero infrastructure (verified with etcd unreachable)

Dead architecture removed

BookRepository, ICatalogQueryRepository, IPatronRepository, EmailTemplate, ITemplateRenderer — all zero-use.

Enforcement (the part that keeps it fixed)

• mypy clean on 134 files, configured in pyproject; SQLAlchemy legacy-Column noise scoped to persistence adapters with a documented override
• GitHub Actions CI: mypy + the infrastructure-free test suites on every push/PR
• mypy immediately paid for itself with two real defects: three patron routes dereferencing a possibly-None query result (500 on a missing patron), and the reservation reaper calling find_expired_reservations which existed on the concrete repository but not on its port

Verification

• 157 tests passing; mechanical dependency sweep now: domain→outward 0, application→infra 0, sqlalchemy in presentation 0
• Live: factory-composed app healthy behind nginx, borrow saga end-to-end, health endpoints working through the container-provided registry