[Architecture][Medium] Enforce Controller and DDD structure rules in architecture tests

[BechsteinDigital]

Severity

Medium / systemic maintainability risk

Problem

Repository rules require Controller APIs, explicit Api/Workspace and Api/Admin separation, and Application code without HTTP/framework concerns. Active Core/Administration/Workspace code still contains many static Minimal API endpoint files. Communication places HTTP-specific route handlers and response concerns under Application/Admin.

Existing architecture tests pass and therefore do not enforce the declared target.

Evidence

• CODE_STRUCTURE_RULES.md:46
• CODE_STRUCTURE_RULES.md:57
• custom/static-plugins/Communication/src/Application/Admin/CallAdminRoutes.cs:20
• Endpoint classes under src/Administration/Api/, src/Core/Api/ and src/Workspace/Api/

Acceptance criteria

• Architecture tests reject new Minimal API endpoint mappings outside an explicitly time-boxed migration allowlist.
• HTTP-specific Communication types move under Api/Admin or Api/Workspace.
• Application handlers depend only on Domain/Application contracts.
• Existing violations are inventoried and migrated incrementally.
• The allowlist can only shrink.
• Controller and DTO type/file conventions are enforced automatically.