feat: attention-optimized semantic protocol v2.7

Core changes:
- Add @defgroup/@ingroup to 1791 C2+ contracts (555 files) for HCA 128× pre-training DSA grouping
- Add §0.1 Pre-Training Frequency matrix to semantics-core
- Add §VIII Attention Architecture rules (ATTN_1-4) with MLA/CSA/HCA/DSA mechanics
- Add @defgroup/@ingroup to canonical syntax (§II) and all contract examples

Agent prompts (5 files):
- Add ZERO-STATE RATIONALE with MLA/CSA/HCA/DSA compression mechanics
- Add pre-training note: @RATIONALE/@REJECTED are in-context learned tags
- svelte-coder: add missing #region contract, fix Svelte rule violations
- python-coder/fullstack-coder: honor function contracts from speckit plan
- qa-tester: add attention compliance audit (P3 ATTN_1-4 checks)

Skills (6 files):
- Translate all axiom_config descriptions to English
- Fix doc_dirs to index .opencode/ and .specify/
- Deduplicate 5× complexity_rules → single global_tags catalog
- Reduce semantics-svelte 591→485 lines (remove duplicate code blocks)
- Fix semantics-testing: 'Short IDs' → 'Short hierarchical IDs'
- Fix all examples: flat IDs → hierarchical Domain.Name format
- Fix Svelte examples: replace raw Tailwind + <button> with semantic tokens + /ui

Speckit workflow (commands + templates):
- speckit.plan: add Function-Level Contracts for C3+ with @PRE/@POST/@TEST_EDGE
- speckit.plan: add Attention Compliance Gate (ATTN_1-4 before contract generation)
- speckit.tasks: add function contract inlining format (constraints in task description)
- speckit.specify: load semantics-core for spec density rules
- spec-template: add #region contract, @SEMANTICS grouping, hierarchical IDs
- ux-reference-template: add #region wrapper
- plan-template: add attention gate, @defgroup/@ingroup guidance
- tasks-template: add attention audit + rebuild + orphan check tasks
- constitution.md: translate to English, add Principle VIII (attention-optimized contracts)

Reference modules rewritten (hierarchical IDs + full contracts):
- Auth.Jwt: 6 child contracts with @RATIONALE/@REJECTED/@TEST_EDGE
- Api.Auth: 5 endpoints with @TEST_EDGE + molecular CoT markers
- Migration.Model: @defgroup Migration with 18 @ACTION + 6 @INVARIANT

Scripts:
- add_defgroup_ingroup.py: zero-risk additive @ingroup migration (1791 insertions)
- migrate_hierarchical.py: flat→hierarchical ID dry-run analysis (792 contracts)
- merge_prompts.py: merge all prompts/skills/commands into one review file

Config:
- axiom_config.yaml: 749→395 lines (-47%), English, doc_dirs include prompts
- Fix test_datasets.py import collision (rename → test_datasets_routes.py)
- Fix test_preview.py: SupersetClient→get_superset_client, AsyncMock, logger f-string

backend/src/app.py

@@ -1,4 +1,5 @@
 # #region AppModule [C:5] [TYPE Module] [SEMANTICS fastapi, websocket, startup, scheduler, middleware]
+# @defgroup Module Module group.
 # @BRIEF The main entry point for the FastAPI application.
 # @LAYER API
 # @RELATION DEPENDS_ON -> [ApiRoutesModule]
@@ -63,6 +64,7 @@ from .models.auth import Role, User
 
 
 # #region lifespan [C:3] [TYPE Function]
+# @ingroup Module
 # @BRIEF Async context manager for FastAPI startup/shutdown lifecycle.
 # @RELATION CALLS -> [init_db]
 # @RELATION CALLS -> [AppDependencies]
@@ -113,6 +115,7 @@ async def lifespan(app: FastAPI):
     scheduler.stop()
 # #endregion lifespan
 # #region FastAPI_App [C:3] [TYPE Global] [SEMANTICS app, fastapi, instance, route-registry]
+# @ingroup Module
 # @BRIEF Canonical FastAPI application instance for route, middleware, and websocket registration.
 # @RELATION DEPENDS_ON -> [ApiRoutesModule]
 # @RELATION BINDS_TO -> [API_Routes]
@@ -133,6 +136,7 @@ from .core.middleware.trace import TraceContextMiddleware  # noqa: E402
 app.add_middleware(TraceContextMiddleware)
 # #endregion FastAPI_App
 # #region ensure_initial_admin_user [C:3] [TYPE Function]
+# @ingroup Module
 # @BRIEF Ensures initial admin user exists when bootstrap env flags are enabled.
 # @RELATION DEPENDS_ON -> [AuthRepository]
 def ensure_initial_admin_user() -> None:
@@ -187,6 +191,7 @@ def ensure_initial_admin_user() -> None:
         db.close()
 # #endregion ensure_initial_admin_user
 # #region run_alembic_migrations [C:2] [TYPE Function]
+# @ingroup Module
 # @BRIEF Applies all pending Alembic migrations against DATABASE_URL.
 #   DEPRECATED: Migrations now run exclusively in docker/backend.entrypoint.sh.
 #   Kept for local development (manual invocation).
@@ -217,6 +222,7 @@ def run_alembic_migrations() -> None:
 
 
 # #region app_middleware [TYPE Block]
+# @ingroup Module
 # @BRIEF Configure application-wide middleware (Session, CORS).
 # @RATIONALE SessionMiddleware uses SESSION_SECRET_KEY independent of JWT SECRET_KEY (see [SEC:H-4]).
 #            CORS allow_origins crashes early if ALLOWED_ORIGINS is unset — no "*" fallback (see [SEC:M-1]).
@@ -277,6 +283,7 @@ class HSTSMiddleware(BaseHTTPMiddleware):
 app.add_middleware(HSTSMiddleware)
 # #endregion app_middleware
 # #region global_exception_handler [C:2] [TYPE Function]
+# @ingroup Module
 # @BRIEF Global exception handler — logs all unhandled 500 errors into the app logger.
 # @PRE request is a FastAPI Request object.
 # @POST Logs full traceback to superset_tools_app logger; returns 500.
@@ -317,6 +324,7 @@ async def network_error_handler(request: Request, exc: NetworkError):
         )
 # #endregion network_error_handler
 # #region log_requests [C:3] [TYPE Function]
+# @ingroup Module
 # @BRIEF Middleware to log incoming HTTP requests and their response status.
 # @RELATION DEPENDS_ON -> [LoggerModule]
 # @PRE request is a FastAPI Request object.
@@ -358,6 +366,7 @@ async def log_requests(request: Request, call_next):
             )
 # #endregion log_requests
 # #region API_Routes [C:3] [TYPE Block]
+# @ingroup Module
 # @BRIEF Register all FastAPI route groups exposed by the application entrypoint.
 # @RELATION DEPENDS_ON -> [FastAPI_App]
 # @RELATION DEPENDS_ON -> [Route_Group_Contracts]
@@ -465,6 +474,7 @@ async def _authenticate_websocket(websocket: WebSocket, endpoint_name: str) -> b
 # #endregion _authenticate_websocket
 
 # #region websocket_endpoint [C:5] [TYPE Function]
+# @ingroup Module
 # @BRIEF Provides a WebSocket endpoint for real-time log streaming of a task with server-side filtering.
 # @RELATION CALLS -> [TaskManagerPackage]
 # @RELATION DEPENDS_ON -> [LoggerModule]
@@ -688,6 +698,7 @@ async def websocket_endpoint(
 # #endregion websocket_endpoint
 
 # #region task_events_websocket [C:4] [TYPE Function]
+# @ingroup Module
 # @BRIEF WebSocket endpoint for global task events (status changes for ALL tasks).
 # @RELATION CALLS -> [TaskManagerPackage]
 # @PRE WebSocket must be authenticated via `token` query param.
@@ -735,6 +746,7 @@ async def task_events_websocket(websocket: WebSocket):
 # #endregion task_events_websocket
 
 # #region maintenance_events_websocket [C:4] [TYPE Function]
+# @ingroup Module
 # @BRIEF WebSocket endpoint for maintenance events (created/ended/banner changes).
 # @RELATION CALLS -> [TaskManagerPackage]
 # @PRE WebSocket must be authenticated via `token` query param.
@@ -782,6 +794,7 @@ async def maintenance_events_websocket(websocket: WebSocket):
 # #endregion maintenance_events_websocket
 
 # #region dataset_websocket_endpoint [C:4] [TYPE Function]
+# @ingroup Module
 # @BRIEF WebSocket endpoint for dataset.updated events — auto-refresh on task completion.
 # @RELATION CALLS -> [TaskManagerPackage]
 # @PRE env_id must reference a known environment.
@@ -815,6 +828,7 @@ async def dataset_websocket_endpoint(websocket: WebSocket, env_id: str):
             logger.reflect("Released dataset event subscription", extra={"env_id": env_id})
 # #endregion dataset_websocket_endpoint
 # #region translate_run_websocket [C:3] [TYPE Function]
+# @ingroup Module
 # @BRIEF WebSocket endpoint for translation run progress — streams structured status updates.
 # @PRE run_id must be a valid translation run ID. WebSocket authenticated via `token` query param.
 # @POST Streams run status JSON every second until terminal state or disconnect.