Phases 3 & 4: Complete data access architecture migration

Phase 3 — eliminated ApplicationDbContext from all non-exempt controllers,
routing all data access through IUnitOfWork. Added IPlainRepository<T> for
the four platform entities (Announcement, BannedIp, DashboardTip, ReleaseNote)
that intentionally don't extend BaseEntity and therefore can't use the
constrained IRepository<T>. Added permanent-exception comments to the 18
controllers that legitimately retain direct DbContext access (Identity infra,
cross-tenant platform ops, bulk streaming exports).

Phase 4 — added EnforceDataAccessArchitecture() to Program.cs, a startup
gate that reflects over every Controller subclass and throws at boot if any
non-exempt controller injects ApplicationDbContext. The app cannot start with
a violation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Infrastructure/Repositories/PlainRepository.cs

@@ -0,0 +1,73 @@
+using System.Linq.Expressions;
+using Microsoft.EntityFrameworkCore;
+using PowderCoating.Core.Interfaces;
+using PowderCoating.Infrastructure.Data;
+
+namespace PowderCoating.Infrastructure.Repositories;
+
+/// <summary>
+/// Generic repository for platform-level entities that do not inherit BaseEntity
+/// (Announcement, BannedIp, DashboardTip, ReleaseNote).  No global query filters apply
+/// to these entities, so no IgnoreQueryFilters support is needed.  All writes are staged
+/// in the EF change tracker — call IUnitOfWork.CompleteAsync() to flush.
+/// </summary>
+public class PlainRepository<T> : IPlainRepository<T> where T : class
+{
+    protected readonly ApplicationDbContext _context;
+    protected readonly DbSet<T> _dbSet;
+
+    public PlainRepository(ApplicationDbContext context)
+    {
+        _context = context;
+        _dbSet = context.Set<T>();
+    }
+
+    public virtual async Task<T?> GetByIdAsync(int id)
+        => await _dbSet.FindAsync(id);
+
+    public virtual async Task<IEnumerable<T>> GetAllAsync()
+        => await _dbSet.ToListAsync();
+
+    public virtual async Task<IEnumerable<T>> FindAsync(Expression<Func<T, bool>> predicate)
+        => await _dbSet.Where(predicate).ToListAsync();
+
+    public virtual async Task<T?> FirstOrDefaultAsync(Expression<Func<T, bool>> predicate)
+        => await _dbSet.FirstOrDefaultAsync(predicate);
+
+    public virtual async Task<bool> AnyAsync(Expression<Func<T, bool>> predicate)
+        => await _dbSet.AnyAsync(predicate);
+
+    public virtual async Task<int> CountAsync(Expression<Func<T, bool>>? predicate = null)
+        => predicate == null ? await _dbSet.CountAsync() : await _dbSet.CountAsync(predicate);
+
+    public virtual async Task<T> AddAsync(T entity)
+    {
+        await _dbSet.AddAsync(entity);
+        return entity;
+    }
+
+    public virtual async Task<IEnumerable<T>> AddRangeAsync(IEnumerable<T> entities)
+    {
+        await _dbSet.AddRangeAsync(entities);
+        return entities;
+    }
+
+    public virtual Task UpdateAsync(T entity)
+    {
+        _dbSet.Update(entity);
+        return Task.CompletedTask;
+    }
+
+    public virtual async Task DeleteAsync(T entity)
+    {
+        _dbSet.Remove(entity);
+        await Task.CompletedTask;
+    }
+
+    public virtual async Task DeleteAsync(int id)
+    {
+        var entity = await GetByIdAsync(id);
+        if (entity != null)
+            await DeleteAsync(entity);
+    }
+}