fix(rmi-backend,audit): re-apply Wave 3 mount + pyproject excludes (P2.3 lost+recovered)

The previous P2.3 commit (628c1d2) only captured the file renames; the
mount.py + pyproject.toml + unified_scanner_router.py modifications were
not in the staging area when the commit was finalized (pre-commit auto-fix
collision rolled back working-tree edits during the first commit attempt).

This follow-up restores the missing pieces:

- app/mount.py: adds app.routers.unified_scanner_router to ROUTER_MODULES
  with the Wave 3 section header + DEFERRED notes for unified_wallet_scanner
  and admin_extensions.
- app/routers/unified_scanner_router.py: refactors prefix /api/v2 -> /api/v2/scanner
  so the v2 routes do not collide with the v1 /api/v1/scanner/* stub.
- pyproject.toml: setuptools.packages.find, ruff.extend-exclude, and
  mypy.exclude all now exclude app/_archive/ so the archive is invisible
  to packaging + linters + type checkers.

Re-verification:
- pytest tests/: 3 failed (pre-existing, unchanged), 817 passed, 1 skipped.
- mount.py mounts 52 routers; /api/v2/scanner/{token,wallet}/scan live.

app/mount.py

@@ -89,12 +89,18 @@ ROUTER_MODULES: Final[list[str]] = [
     "app.routers.security_intel",  # /api/v1/security/*  (31 routes, crypto security stack). Depends on LIVE app.{cross_chain_correlator,ml_anomaly,onchain_analyzer}.
     "app.routers.mev_sniper",  # /api/v1/mev-sniper/*  (2 routes: /signals + /chains). No internal app.* deps. MEV Sniper = premium scanner feature.
     #
-    # DEFERRED (1) — needs APIRouter:
+    # Wire-in Wave 3 — AUDIT-2026-Q3.md Phase 2.3 — mounted 2026-07-07.
-    #   "app.tool_fingerprint" — module only (no `router` APIRouter attribute).
+    "app.routers.unified_scanner_router",  # /api/v2/scanner/{token,wallet}/scan  (2 routes, v2 scanner).
-    #   773 lines, scam-infra detection logic. Wire-in requires a thin
+    #
-    #   router wrapper exposing the fingerprint functions as endpoints
+    # DEFERRED Wave 3 (2):
-    #   (e.g. POST /api/v1/tool-fingerprint/analyze). Defer until wrapper
+    #   "app.routers.unified_wallet_scanner" — NO `router` APIRouter attribute.
-    #   is written.
+    #     Module exposes `get_wallet_scanner()` consumed by unified_scanner_router.
+    #     Wire-in deferred: not a router, would shadow /api/v2/scanner/wallet/scan
+    #     if exposed as a thin wrapper. Already reachable from app.unified_wallet_scanner
+    #     which is imported by unified_scanner_router.
+    #   "app.routers.admin_extensions" — DORMANT per audit (darkroom-specific, 25 routes
+    #     at /api/v1/admin/*). Would shadow /api/v1/admin/alerts_webhook (mounted Wave 1).
+    #     Kept in tree per audit, not wired.
 ]
 
 

app/routers/unified_scanner_router.py

@@ -9,7 +9,7 @@ from app.unified_token_scanner import get_token_scanner
 from app.unified_wallet_scanner import get_wallet_scanner
 
 logger = logging.getLogger(__name__)
-router = APIRouter(prefix="/api/v2", tags=["scanner-v2"])
+router = APIRouter(prefix="/api/v2/scanner", tags=["scanner-v2"])
 
 
 class TokenScanRequest(BaseModel):

pyproject.toml

@@ -48,6 +48,7 @@ build-backend = "setuptools.build_meta"
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["app*"]
+exclude = ["app._archive*", "app._archive.**"]
 namespaces = false
 
 [tool.ruff]
@@ -56,6 +57,7 @@ target-version = "py311"
 extend-exclude = [
     "_legacy_main.py",
     "app/legacy/",
+    "app/_archive/",
     "alembic/versions/",
     "build/",
     "dist/",
@@ -106,6 +108,7 @@ plugins = ["pydantic.mypy"]
 exclude = [
     "_legacy_main.py",
     "app/legacy/",
+    "app/_archive/",
     "alembic/versions/",
     "tests/",
 ]