feat(arch): add API-007 rule to enforce layered architecture

Add architecture rule that detects when API routes import database
models directly, enforcing Routes → Services → Models pattern.

Changes:
- Add API-007 rule to .architecture-rules/api.yaml
- Add _check_no_model_imports() validation to validator script
- Update customer imports to use canonical module location
- Add storefront module restructure implementation plan

The validator now detects 81 violations across 67 API files where
database models are imported directly instead of going through
services. This is Phase 1 of the storefront restructure plan.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/modules/analytics/services/stats_service.py

@@ -19,7 +19,7 @@ from sqlalchemy import func
 from sqlalchemy.orm import Session
 
 from app.exceptions import AdminOperationException, VendorNotFoundException
-from models.database.customer import Customer
+from app.modules.customers.models.customer import Customer
 from models.database.inventory import Inventory
 from models.database.marketplace_import_job import MarketplaceImportJob
 from models.database.marketplace_product import MarketplaceProduct

app/modules/loyalty/services/card_service.py

@@ -144,7 +144,7 @@ class CardService:
         Returns:
             (cards, total_count)
         """
-        from models.database.customer import Customer
+        from app.modules.customers.models.customer import Customer
 
         query = (
             db.query(LoyaltyCard)

app/modules/messaging/services/messaging_service.py

@@ -25,7 +25,7 @@ from app.modules.messaging.models.message import (
     MessageAttachment,
     ParticipantType,
 )
-from models.database.customer import Customer
+from app.modules.customers.models.customer import Customer
 from models.database.user import User
 
 logger = logging.getLogger(__name__)