refactor: split gateway and pi-qmem extension into modules

- gateway: separate config, models, state, audit, guardrail, embeddings,
  store, metrics, cleanup and routes; keep main.py as FastAPI bootstrap
- extension: split client/config, six tools, config command and rules;
  preserve jiti entrypoint and registrations
- Dockerfile copies the complete gateway module set
- tests: update monkeypatch boundaries for modular config/state

gateway/tests/conftest.py

@@ -121,13 +121,15 @@ class FakeQdrant:
 def client(monkeypatch):
     """TestClient con qdrant e embed finti."""
     fake = FakeQdrant()
+    monkeypatch.setattr(gateway.state, "qdrant", fake)
     monkeypatch.setattr(gateway, "qdrant", fake)
-    monkeypatch.setattr(gateway, "API_KEYS", {"test-key"})
-    monkeypatch.setattr(gateway, "_ratelimit", {})  # rate limit pulito per test
+    monkeypatch.setattr(gateway, "API_KEYS", {"test-key"}, raising=False)
+    monkeypatch.setattr(gateway.state, "ratelimit", {})  # rate limit pulito per test
 
     async def fake_embed(text):
         return [0.0] * 1024
 
+    monkeypatch.setattr(gateway.state, "embed", fake_embed)
     monkeypatch.setattr(gateway, "embed", fake_embed)
 
     from fastapi.testclient import TestClient

gateway/tests/test_api.py

@@ -63,7 +63,9 @@ def test_chiave_invalida_401(client):
 
 
 def test_rate_limit_429(client, monkeypatch):
-    monkeypatch.setattr("main.RATE_LIMIT_PER_MIN", 3)
+    import config
+
+    monkeypatch.setattr(config, "RATE_LIMIT_PER_MIN", 3)
     for _ in range(3):
         r = client.post("/v1/memories", json=make_record(), headers=auth_headers())
         assert r.status_code == 200

gateway/tests/test_guardrail.py

@@ -12,9 +12,9 @@ from conftest import auth_headers, make_record
 @pytest.fixture(autouse=True)
 def enable_guardrail(monkeypatch):
     """Abilita il guardrail per i test di questa suite (il conftest lo disabilita di default)."""
-    import main as gateway
+    import config
 
-    monkeypatch.setattr(gateway, "GUARDRAIL_ENABLED", True)
+    monkeypatch.setattr(config, "GUARDRAIL_ENABLED", True)
 
 
 def test_duplicato_esatto_bloccato_409(client):
@@ -91,9 +91,9 @@ def test_supersede_bypassa_guardrail(client):
 
 def test_guardrail_disabilitato_salva_sempre(client, monkeypatch):
     """Con GUARDRAIL_ENABLED=false non si blocca nulla."""
-    import main as gateway
+    import config
 
-    monkeypatch.setattr(gateway, "GUARDRAIL_ENABLED", False)
+    monkeypatch.setattr(config, "GUARDRAIL_ENABLED", False)
     client.fake_qdrant.query_score = 0.9
     r1 = client.post("/v1/memories", json=make_record(text="primo"), headers=auth_headers())
     assert r1.status_code == 200