Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/fixtures/qonto/organization.json

@@ -0,0 +1,31 @@
+{
+  "organization": {
+    "name": "Binky Hedgehog GmbH",
+    "legal_name": "Binky Hedgehog GmbH",
+    "slug": "binky-hedgehog-gmbh-6923",
+    "legal_country": "DE",
+    "legal_registration_date": "2019-03-15",
+    "bank_accounts": [
+      {
+        "name": "Hauptkonto",
+        "slug": "main-account",
+        "currency": "EUR",
+        "balance": 2185.94,
+        "authorized_balance": 2185.94,
+        "iban": "DE02100100101234566810",
+        "main": true,
+        "status": "active"
+      },
+      {
+        "name": "Kickstart Business",
+        "slug": "secondary-account",
+        "currency": "EUR",
+        "balance": 0.0,
+        "authorized_balance": 0.0,
+        "iban": "DE02100100101234567038",
+        "main": false,
+        "status": "active"
+      }
+    ]
+  }
+}

tests/fixtures/qonto/transactions.json

@@ -0,0 +1,64 @@
+{
+  "transactions": [
+    {
+      "id": "tx-qonto-2026-07",
+      "settled_at": "2026-07-01T08:00:00Z",
+      "label": "Qonto",
+      "side": "debit",
+      "amount": 70.8,
+      "currency": "EUR",
+      "category": "subscription",
+      "operation_type": "qonto_fee",
+      "status": "completed",
+      "iban": "DE02100100101234566810"
+    },
+    {
+      "id": "tx-hub31-2026-06",
+      "settled_at": "2026-06-02T08:00:00Z",
+      "label": "HUB31",
+      "side": "debit",
+      "amount": 297.5,
+      "currency": "EUR",
+      "category": "other_expense",
+      "operation_type": "transfer",
+      "status": "completed",
+      "iban": "DE02100100101234566810"
+    },
+    {
+      "id": "tx-hub31-2026-05",
+      "settled_at": "2026-05-02T08:00:00Z",
+      "label": "HUB31",
+      "side": "debit",
+      "amount": 297.5,
+      "currency": "EUR",
+      "category": "other_expense",
+      "operation_type": "transfer",
+      "status": "completed",
+      "iban": "DE02100100101234566810"
+    },
+    {
+      "id": "tx-stripe-2026-06",
+      "settled_at": "2026-06-29T08:00:00Z",
+      "label": "Stripe Technology Europe Ltd",
+      "side": "credit",
+      "amount": 8.55,
+      "currency": "EUR",
+      "category": "other_income",
+      "operation_type": "income",
+      "status": "completed",
+      "iban": "DE02100100101234566810"
+    },
+    {
+      "id": "tx-old-window",
+      "settled_at": "2026-02-01T08:00:00Z",
+      "label": "Old Expense",
+      "side": "debit",
+      "amount": 12.34,
+      "currency": "EUR",
+      "category": "other_expense",
+      "operation_type": "income",
+      "status": "completed",
+      "iban": "DE02100100101234566810"
+    }
+  ]
+}