Complete Phase 1: policy kernel, REST service, and local smoke tooling

Implements QONTO-WP-0002 (policy-gated Qonto REST service with audit
logging, rate limiting, and credential handling) and the ADHOC-2026-07-21
follow-up (fixture-backed local smoke mode, repo classification metadata).
Marks QONTO-WP-0001/0002 and the ad-hoc workplan finished, and regenerates
WORK-RECORDS.md and the ADHOC workplan's state_hub_workstream_id via
fix-consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_fixture_client.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+
+from qonto_assistant.qonto_client import FixtureQontoClient
+
+FIXTURE_DIR = Path(__file__).resolve().parent / "fixtures" / "qonto"
+
+
+def test_fixture_client_loads_fixture_payloads() -> None:
+    client = FixtureQontoClient(fixture_dir=FIXTURE_DIR)
+
+    organization = client.get_organization()
+
+    assert organization["organization"]["name"] == "Binky Hedgehog GmbH"
+    assert len(organization["organization"]["bank_accounts"]) == 2
+
+
+def test_fixture_client_filters_window_and_pagination() -> None:
+    client = FixtureQontoClient(fixture_dir=FIXTURE_DIR)
+
+    payload = client.list_transactions(
+        iban="DE02100100101234566810",
+        page=1,
+        page_size=2,
+        window_days=31,
+        status="completed",
+        side=None,
+    )
+
+    transactions = payload["transactions"]
+    assert len(transactions) == 2
+    assert transactions[0]["id"] == "tx-qonto-2026-07"
+    assert all(item["id"] != "tx-old-window" for item in transactions)