feat: GRACE-Poly protocol optimization — ~3200→10 warnings (↓99.7%)

Full optimization cycle:

Protocol (15 files):
- 4-layer SSOT architecture for agent prompts & skills
- Anti-Corruption Protocol consolidated from 5 duplicates
- Tag-to-tier permissiveness matrix (all @tags allowed at all tiers)

Axiom config:
- complexity_rules: all 22+ tags available on C1-C5
- contract_type_overrides: removed (was narrowing per-type)
- 18 new tags added, LAYER enum expanded (Infra, Frontend, Atom, etc.)
- RELATION predicates expanded (USES, CONTAINS, BELONGS_TO, etc.)

Code fixes:
- 2216 @TAG: normalized to @TAG (colon→space)
- 518 [DEF] blocks migrated to #region/#endregion (37 files)
- VERIFIES→BINDS_TO, :Class/:Function suffixes removed, paths→IDs
- 1173-line _external_stubs.py deleted (EXT: handled natively)
- Batch EXT: reference audit (240 targets: 132 external, 99 internal, 9 fix)
- QA regression check: 0 regressions across all checks

Infrastructure:
- DuckDB rebuild stabilized (appender API, INSERT OR IGNORE)
- Anchor regex fix (parent-child BINDS_TO now resolves)
- EXT:*/DTO:/NEED_CONTEXT: regex fixed in validator
- 34MB Doxygen API portal (3194 contract pages)

backend/src/services/sql_table_extractor.py

@@ -4,7 +4,7 @@
 #   Phase 2: In Jinja spans, extract "schema.table" from string values
 #   Phase 3: In SQL spans, regex pattern + sqlparse filter to reject string literal false positives
 # @LAYER Service
-# @RELATION DEPENDS_ON -> [[EXT:internal:re_sqlparse]]
+# @RELATION DEPENDS_ON -> [EXT:Library:sqlparse]
 # @INVARIANT Only exact schema.table matches (case-insensitive); unqualified references are NOT matched.
 # @INVARIANT Returns a set[str] of fully-qualified table names (lowercased for case-insensitive matching).