## Summary
<!-- What does this PR do? -->

## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor
- [ ] Documentation
- [ ] CI/CD

## Checklist
- [ ] `ruff check app/ tests/` passes
- [ ] `bandit -r app/ -q` passes
- [ ] `pytest tests/ --cov=app --cov-fail-under=70` passes
- [ ] Architecture doc updated if agent flow changed