feat(ci): evaluate API doctor tools similar to React Doctor

[masch]

Problem

The PR workflow runs react-doctor (diff scan + full scan) for mobile changes, but the API validation only has tests + typecheck — no equivalent static analysis "doctor" step.

Proposed Solution

Evaluate adding a static analysis "doctor" for the API. Options to consider:

Tool	What it does
Knip	Detect dead files, exports, and dependencies
dependency-cruiser	Enforce architecture rules (e.g. "routes can import db, but db cannot import routes")
eslint-plugin-security	Catch SQL injection, eval, regex DoS patterns
Oxlint (Oxc)	700+ Rust-based rules, faster ESLint alternative
Betterer	Track regressions incrementally over time

Goal

Define what checks an "API doctor" should cover:

• Dead code / unused exports
• Architecture boundary violations
• Security anti-patterns in Hono routes
• Regressions across PRs (diff scan)

Next Steps

1. Research each tool against the Hono + Drizzle stack
2. Decide which tools to adopt
3. Create a make api-doctor target
4. Wire into validate-api in pr.yml