build(rmi-backend,audit): declare app/ as installable Python package

Phase 1 of AUDIT-2026-Q3.md item P1.3.

33 of 35 unit test files fail pytest collection without PYTHONPATH=.
Because pyproject.toml did not declare app/ as a package, pip install -e
".[dev]" did not register app as importable. After this commit:
- pip install -e .[dev] installs app as a real package
- pytest tests/ --collect-only works from any cwd without PYTHONPATH=
- New devs can follow README.md verbatim (no PYTHONPATH= env var)

Used [tool.setuptools.packages.find] with include = ["app*"] and
namespaces = false to auto-discover every sub-package that has __init__.py
(414 sub-packages). Sub-packages without __init__.py are namespace
packages and remain out of scope for Phase 1.3 (tracked for Phase 3):
  app/middleware, app/telegram_bot, app/routers, app/domain/threat,
  app/api/v1/rag, app/protection_api, app/services, app/mcp/tools.

Verified: from /tmp without PYTHONPATH, "import app" works and
"pytest tests/ --collect-only" reports 765 tests collected. The 8
remaining collection errors are pre-existing missing optional deps
(aiohttp in app/profile_flip_detector, app/bridge_health_monitor;
numpy in app/rag/ann_index) — unrelated to this fix.

pyproject.toml

@@ -39,6 +39,17 @@ dev = [
 requires = ["setuptools>=68", "wheel"]
 build-backend = "setuptools.build_meta"
 
+# Declare app/ as an installable package so `pip install -e ".[dev]"` registers
+# it on sys.path. Without this, pytest collection fails outside the repo cwd
+# (33/35 test files fail without PYTHONPATH=.).
+# packages.find auto-discovers every sub-package that has __init__.py.
+# Sub-packages without __init__.py are namespace packages and remain out of
+# scope for Phase 1.3 (tracked for Phase 3).
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["app*"]
+namespaces = false
+
 [tool.ruff]
 line-length = 100
 target-version = "py311"