Architecture boundaries enforced via dependency-cruiser

The kit now ships with dependency-cruiser at the root. Boundaries that used to live in reviewer memory are now mechanical rules.

What's enforced (errors)

packages/** may not import apps/** — apps depend on packages, never the inverse.
apps/web and apps/dev-tool are separate deploy units — no code cross-import.
apps/e2e is sealed — nothing outside it may import from it.
@kit/shared and @kit/crypto are foundation — zero @kit/* deps.
Social-stack layering — social-core at the bottom; social-meta and social-tiktok are isolated siblings; jobs-* and crypto cannot import any social-*.

pnpm depcruise        # interactive
pnpm depcruise:check  # CI-style
pnpm depcruise:graph  # writes .dependency-cruiser/graph.dot

Hooked into pnpm healthcheck and a new CI job.

docs/development-guide/dependency-cruiser.mdoc covers reading violations, authoring new rules, and the V1 follow-on bucket.