chore(#2807): add detekt static analysis with baseline + repo config

[Skobeltsyn]

Adds the detekt Gradle plugin (1.23.7), a tuned detekt.yml for the categories the maintainability audit (#2790) flagged, and a generated detekt-baseline.xml freezing existing violations so the build stays green on this PR while new code is held to the rules.

What's enabled:

• complexity (LongMethod, LargeClass, CyclomaticComplexMethod, NestedBlockDepth) — long methods and god classes were exactly what the audit surfaced.
• exceptions (SwallowedException, TooGenericExceptionCaught, TooGenericExceptionThrown) — backstops the FINE-log discipline from #2805.
• style (MagicNumber, UnusedPrivateMember) — catches the #2806 dead- RESET / #2804 unexplained-literal categories.
• naming (FunctionNaming) — the framework already follows lowerCamel; the rule prevents drift.
• potential-bugs (UnreachableCode, AvoidReferentialEquality).
• empty-blocks (EmptyFunctionBlock with ignoreOverridden).

Magic-number allowlist includes the small integers (-1, 0, 1, 2, 10, 100, 1000) plus ignoreEnums / ignoreCompanionObjectPropertyDeclaration / ignoreNamedArgument / ignoreConstantDeclaration / ignoreRanges so the bulk of the false-positive surface stays quiet without losing signal on genuine magic in business logic.

Wired in build.gradle.kts:

• Plugin applied at root.
• detekt { config / baseline / buildUponDefaultConfig } block.
• tasks.withType<Detekt> sets jvmTarget=21 and enables HTML+XML reports (build/reports/detekt/detekt.html for the human view).

README updated to mention ./gradlew detekt alongside ./gradlew test in the "First 10 Minutes / build from source" block.

Deferred (commit-body honesty):

• formatting rule set (ktlint integration) is OFF — adopting ktlint is its own design decision and would generate thousands of style diffs across the 13k-LOC codebase. Pick that up when there's appetite.
• ForbiddenComment is OFF — detekt 1.23's comments schema is fiddly; revisit on next plugin bump.
• CI workflow wiring (the .github/workflows/*.yml lift) is a separate ticket; the manual ./gradlew detekt invocation works today.

Full ./gradlew test + detekt green; 254+ TEST-*.xml files, zero failures/errors. Baseline file is 788 lines — every snapshot point documented in one place so cleanup tickets can chip away.