refactor: split gateway and pi-qmem extension into modules

- gateway: separate config, models, state, audit, guardrail, embeddings,
  store, metrics, cleanup and routes; keep main.py as FastAPI bootstrap
- extension: split client/config, six tools, config command and rules;
  preserve jiti entrypoint and registrations
- Dockerfile copies the complete gateway module set
- tests: update monkeypatch boundaries for modular config/state

gateway/tests/conftest.py

@@ -121,13 +121,15 @@ class FakeQdrant:
 def client(monkeypatch):
     """TestClient con qdrant e embed finti."""
     fake = FakeQdrant()
+    monkeypatch.setattr(gateway.state, "qdrant", fake)
     monkeypatch.setattr(gateway, "qdrant", fake)
-    monkeypatch.setattr(gateway, "API_KEYS", {"test-key"})
-    monkeypatch.setattr(gateway, "_ratelimit", {})  # rate limit pulito per test
+    monkeypatch.setattr(gateway, "API_KEYS", {"test-key"}, raising=False)
+    monkeypatch.setattr(gateway.state, "ratelimit", {})  # rate limit pulito per test
 
     async def fake_embed(text):
         return [0.0] * 1024
 
+    monkeypatch.setattr(gateway.state, "embed", fake_embed)
     monkeypatch.setattr(gateway, "embed", fake_embed)
 
     from fastapi.testclient import TestClient