feat(arch): add API-007 rule to enforce layered architecture

Add architecture rule that detects when API routes import database
models directly, enforcing Routes → Services → Models pattern.

Changes:
- Add API-007 rule to .architecture-rules/api.yaml
- Add _check_no_model_imports() validation to validator script
- Update customer imports to use canonical module location
- Add storefront module restructure implementation plan

The validator now detects 81 violations across 67 API files where
database models are imported directly instead of going through
services. This is Phase 1 of the storefront restructure plan.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/email_service.py

@@ -1122,7 +1122,7 @@ class EmailService:
 
         # 2. Customer's preferred language
         if customer_id:
-            from models.database.customer import Customer
+            from app.modules.customers.models.customer import Customer
 
             customer = (
                 self.db.query(Customer).filter(Customer.id == customer_id).first()