Phases 3 & 4: Complete data access architecture migration

Phase 3 — eliminated ApplicationDbContext from all non-exempt controllers,
routing all data access through IUnitOfWork. Added IPlainRepository<T> for
the four platform entities (Announcement, BannedIp, DashboardTip, ReleaseNote)
that intentionally don't extend BaseEntity and therefore can't use the
constrained IRepository<T>. Added permanent-exception comments to the 18
controllers that legitimately retain direct DbContext access (Identity infra,
cross-tenant platform ops, bulk streaming exports).

Phase 4 — added EnforceDataAccessArchitecture() to Program.cs, a startup
gate that reflects over every Controller subclass and throws at boot if any
non-exempt controller injects ApplicationDbContext. The app cannot start with
a violation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Infrastructure/Repositories/BillRepository.cs

@@ -89,4 +89,17 @@ public class BillRepository : Repository<Bill>, IBillRepository
             .Select(p => p.PaymentNumber)
             .FirstOrDefaultAsync();
     }
+
+    /// <inheritdoc/>
+    public async Task<List<Bill>> GetForDateRangeAsync(DateTime start, DateTime end)
+    {
+        return await _context.Bills
+            .Where(b => !b.IsDeleted && b.BillDate >= start && b.BillDate <= end)
+            .Include(b => b.Vendor)
+            .Include(b => b.LineItems.Where(li => !li.IsDeleted))
+                .ThenInclude(li => li.Account)
+            .Include(b => b.Payments.Where(p => !p.IsDeleted))
+            .OrderBy(b => b.BillDate)
+            .ToListAsync();
+    }
 }