Add data access architecture spec and enforce rules in CLAUDE.md

Defines the target architecture for eliminating direct ApplicationDbContext
injection from controllers. Documents the three-tier model (generic repo,
typed domain repos, read services), the 6 typed repository interfaces to
build, the 2 reporting service interfaces to build, permanent exceptions,
and the 4-phase migration roadmap with per-controller checklist.

CLAUDE.md updated with the hard rule and tier quick-reference so every
session and every team member sees the constraint immediately.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -122,6 +122,49 @@ Company Admin (seed): demo@powdercoatinglogix.com / CompanyAdmin123!
 - Global query filters enforce company isolation at database level
 - Users have both system role (SuperAdmin) and company role (CompanyAdmin, Manager, Worker, Viewer)
 
+## Data Access Rules (ENFORCE THESE)
+
+> **`ApplicationDbContext` is NEVER injected into a controller.**
+> All data access in controllers goes through `IUnitOfWork`. No exceptions outside the list below.
+> Full rationale and migration roadmap: `docs/DATA_ACCESS_ARCHITECTURE.md`
+
+### Three tiers — use the right one:
+
+**Tier 1 — Simple CRUD** → `IUnitOfWork.EntityName` (generic `IRepository<T>`)
+```csharp
+var items = await _unitOfWork.CatalogItems.GetAllAsync();
+await _unitOfWork.Announcements.AddAsync(entity);
+await _unitOfWork.CompleteAsync();
+```
+
+**Tier 2 — Complex domain queries** → typed repositories on `IUnitOfWork`
+```csharp
+// Include chains and domain-specific queries belong in the repository, not the controller
+var job     = await _unitOfWork.Jobs.LoadForDetailsAsync(id);
+var invoice = await _unitOfWork.Invoices.LoadForViewAsync(id);
+var quote   = await _unitOfWork.Quotes.GetByApprovalTokenAsync(token);
+```
+Typed repositories: `IJobRepository`, `IInvoiceRepository`, `IQuoteRepository`,
+`ICustomerRepository`, `IBillRepository`, `IPurchaseOrderRepository`
+— defined in `Core/Interfaces/Repositories/`, implemented in `Infrastructure/Repositories/`
+
+**Tier 3 — Aggregate/reporting queries** → injected read services
+```csharp
+// P&L, AR aging, cycle time, powder usage — shaped DTOs, never tracked entities
+var aging = await _financialReports.GetArAgingAsync(companyId);
+```
+Services: `IFinancialReportService`, `IOperationalReportService`
+— defined in `Core/Interfaces/Services/`, implemented in `Infrastructure/Services/`
+
+### Permanent exceptions (ApplicationDbContext allowed — intentional, documented):
+`StripeWebhookController`, `WebhooksController`, `PaymentController`, `RegistrationController`,
+`DataExportController`, `AccountDataExportController`, `DataPurgeController`,
+`SystemInfoController`, `SystemLogsController`, `CompanyHealthController`
+
+If you think you need a new exception, you almost certainly don't. Check the spec first.
+
+---
+
 ## Data Access Patterns
 
 ### Common Controller Pattern