Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/qonto_assistant/contracts.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Literal
+
+ProtocolName = Literal["rest", "mcp"]
+
+
+@dataclass(frozen=True, slots=True)
+class ActorClaims:
+    actor_id: str
+    tenant_id: str
+    lane: str = "green"
+    scopes: frozenset[str] = field(default_factory=frozenset)
+
+
+@dataclass(frozen=True, slots=True)
+class CapabilityRequest:
+    capability_id: str
+    tenant_id: str
+    actor_claims: ActorClaims
+    resource_scope: str
+    request_args: dict[str, Any]
+    protocol: ProtocolName
+    response_class: str = "operational_summary"
+
+
+@dataclass(frozen=True, slots=True)
+class PolicyDecision:
+    allowed: bool
+    capability_id: str
+    policy_version: int
+    reason: str
+    request_args: dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass(frozen=True, slots=True)
+class QontoCredentials:
+    api_user: str
+    api_key: str
+
+
+@dataclass(frozen=True, slots=True)
+class AuditEvent:
+    request_id: str
+    timestamp: str
+    actor: str
+    tenant_id: str
+    capability: str
+    protocol: ProtocolName
+    decision: str
+    deny_reason: str | None
+    policy_version: int
+    latency_ms: int
+    qonto_http_status: int | None = None
+    result_count: int | None = None