feat(p7): AiJobService + AiBudgetGuard + local inference (gate→budget→propose)

Task 7.3: AiJobService runs scoped/purposed AI jobs that only propose — fails
closed via OPA (KG-03), degrades on budget (AiBudgetGuard sums costUnits, KG-12),
then persists job+modelRun+artifact(PROPOSED)+claims+evidence with full
provenance. CLASSIFY also proposes IiosModerationFlag(proposedBy:'AI'). accept/
reject record human feedback + emit events. Idempotent per job key. INFERENCE_PORT
binds LocalDeterministicInference for nest start; specs inject testkit FakeInference.
8 tests: classify/summarize/extract, fail-closed, budget-degrade, idempotent, accept.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/app.module.ts

@@ -10,6 +10,7 @@ import { InboxModule } from './inbox/inbox.module';
 import { SupportModule } from './support/support.module';
 import { AdaptersModule } from './adapters/adapters.module';
 import { RoutingModule } from './routing/routing.module';
+import { AiModule } from './ai/ai.module';
 import { HealthController } from './health.controller';
 import { DevController } from './dev/dev.controller';
 
@@ -26,6 +27,7 @@ import { DevController } from './dev/dev.controller';
     SupportModule,
     AdaptersModule,
     RoutingModule,
+    AiModule,
   ],
   controllers: [HealthController, DevController],
 })