Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/fixtures/qonto/organization.json

@@ -0,0 +1,31 @@
+{
+  "organization": {
+    "name": "Binky Hedgehog GmbH",
+    "legal_name": "Binky Hedgehog GmbH",
+    "slug": "binky-hedgehog-gmbh-6923",
+    "legal_country": "DE",
+    "legal_registration_date": "2019-03-15",
+    "bank_accounts": [
+      {
+        "name": "Hauptkonto",
+        "slug": "main-account",
+        "currency": "EUR",
+        "balance": 2185.94,
+        "authorized_balance": 2185.94,
+        "iban": "DE02100100101234566810",
+        "main": true,
+        "status": "active"
+      },
+      {
+        "name": "Kickstart Business",
+        "slug": "secondary-account",
+        "currency": "EUR",
+        "balance": 0.0,
+        "authorized_balance": 0.0,
+        "iban": "DE02100100101234567038",
+        "main": false,
+        "status": "active"
+      }
+    ]
+  }
+}