fix(lint): restore noqa directives and register custom codes with ruff

Reverts the noqa: removal — the architecture validators (SVC-006,
SEC-034, MOD-004, API-007) use these to skip known-safe violations.
Added ruff lint.external config so ruff treats them as valid codes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

middleware/auth.py

@@ -502,6 +502,6 @@ class AuthManager:
             db.refresh(admin_user)
 
             # Log creation for audit trail (credentials redacted for security)
-            logger.info("Default admin user created")  # sec-001 sec-021
+            logger.info("Default admin user created")  # noqa: sec-001 sec-021
 
         return admin_user