refactor(backend)!: separate algorithm and data layers

Reorganize algorithm packages by business responsibility, move orchestration into services, and keep database access behind pooled repositories.

Harden analysis API validation, remove unsafe legacy simulation endpoints, and add regression and architecture boundary coverage.

BREAKING CHANGE: legacy algorithm module paths and obsolete simulation endpoints are removed.

tests/api/test_leakage_endpoints.py

@@ -33,3 +33,58 @@ def test_identify_leakage_success(monkeypatch):
     )
     assert response.status_code == 200
     assert response.json()["area_count"] == 0
+
+
+def test_identify_leakage_rejects_server_file_paths():
+    client = _build_client()
+
+    response = client.post(
+        "/api/v1/leakage-identifications",
+        json={
+            "network": "demo",
+            "observed_pressure_data": "/etc/passwd",
+            "output_dir": "/tmp/leakage-results",
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_identify_leakage_rejects_unbounded_workload():
+    client = _build_client()
+
+    response = client.post(
+        "/api/v1/leakage-identifications",
+        json={
+            "network": "demo",
+            "observed_pressure_data": {"S1": [1.0]},
+            "pop_size": 1_000_000,
+            "max_gen": 1_000_000,
+            "n_workers": 10_000,
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_identify_leakage_runs_service_outside_event_loop(monkeypatch):
+    captured = {}
+
+    async def fake_threadpool(func, **kwargs):
+        captured["func"] = func
+        captured["kwargs"] = kwargs
+        return {"rows": [], "area_count": 0}
+
+    monkeypatch.setattr(leakage_endpoint, "run_in_threadpool", fake_threadpool)
+    client = _build_client()
+    response = client.post(
+        "/api/v1/leakage-identifications",
+        json={
+            "network": "demo",
+            "observed_pressure_data": {"S1": [1.0]},
+        },
+    )
+
+    assert response.status_code == 200
+    assert captured["func"] is leakage_endpoint.run_leakage_identification
+    assert captured["kwargs"]["username"] == "tester"