fix: protect critical re-export imports from linter removal

Problem:
- Ruff removed 'from app.core.database import Base' from models/database/base.py
- Import appeared "unused" (F401) but was actually a critical re-export
- Caused ImportError: cannot import name 'Base' at runtime
- Re-export pattern: import in one file to export from package

Solution:
1. Added F401 ignore for models/database/base.py in pyproject.toml
2. Created scripts/verify_critical_imports.py verification script
3. Integrated verification into make check and CI pipeline
4. Updated documentation with explanation

New Verification Script:
- Checks all critical re-export imports exist
- Detects import variations (parentheses, 'as' clauses)
- Handles SQLAlchemy declarative_base alternatives
- Runs as part of make check automatically

Protected Files:
- models/database/base.py - Re-exports Base for all models
- models/__init__.py - Exports Base for Alembic
- models/database/__init__.py - Exports Base from package
- All __init__.py files (already protected)

Makefile Changes:
- make verify-imports - Run import verification
- make check - Now includes verify-imports
- make ci - Includes verify-imports in pipeline

Documentation Updated:
- Code quality guide explains re-export protection
- Pre-commit workflow includes verification
- Examples of why re-exports matter

This prevents future issues where linters remove seemingly
"unused" imports that are actually critical for application structure.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

middleware/auth.py

@@ -204,9 +204,7 @@ class AuthManager:
                 raise InvalidTokenException("Token missing expiration")
 
             # Check if token has expired (additional check beyond jwt.decode)
-            if datetime.now(UTC) > datetime.fromtimestamp(
-                exp, tz=UTC
-            ):
+            if datetime.now(UTC) > datetime.fromtimestamp(exp, tz=UTC):
                 raise TokenExpiredException()
 
             # Validate user identifier claim exists

middleware/vendor_context.py

@@ -141,9 +141,7 @@ class VendorContextManager:
                         f"[OK] Vendor found via custom domain: {domain} → {vendor.name}"
                     )
                     return vendor
-                logger.warning(
-                    f"No active vendor found for custom domain: {domain}"
-                )
+                logger.warning(f"No active vendor found for custom domain: {domain}")
                 return None
 
         # Method 2 & 3: Subdomain or path-based lookup