feat: architectural rule DSL — user-defined boundary enforcement

[bntvllnt]

Summary

Define a declarative DSL for architectural rules that enforces module boundaries, layer dependencies, and naming conventions — checked automatically via MCP and CI.

Motivation

• dependency-cruiser's rule system (18K+ GitHub stars) proves demand
• enforce_architecture (feat: add enforce_architecture MCP tool — architectural guardrails for AI agents #21) provides the runtime — this issue adds the configuration layer
• Enterprise adoption requires customizable rules, not just heuristics
• AI agents need explicit rules to respect architectural boundaries

Proposed DSL (.architecture.yml)

layers:
  - name: controllers
    match: "src/controllers/**"
    allowed-deps: [services, types]
    
  - name: services  
    match: "src/services/**"
    allowed-deps: [models, types, utils]
    
  - name: models
    match: "src/models/**"
    allowed-deps: [types]

rules:
  - name: no-circular-modules
    type: no-circular
    severity: error
    
  - name: max-coupling
    type: metric-threshold
    metric: coupling
    max: 0.7
    severity: warning
    
  - name: max-complexity
    type: metric-threshold  
    metric: cyclomaticComplexity
    max: 15
    severity: warning

Features

1. Layer definitions: glob patterns → allowed dependency targets
2. Metric thresholds: fail on coupling > X, complexity > Y
3. Structural rules: no-circular, max-fan-out, required-tests
4. Severity levels: error (blocks), warning (reports)
5. Auto-generate: codebase-intelligence init-rules infers rules from existing structure

Acceptance Criteria

• .architecture.yml schema defined and validated (zod)
• Rules checked by enforce_architecture tool
• init-rules command generates rules from existing graph
• CI-friendly exit codes (0 = pass, 1 = violations)
• Documentation with examples

Priority

Long-term — Builds on enforce_architecture (#21). High enterprise value.