refactor(architecture): replace blog-content/news-portal circular imports with capability ports #681

Parent epic: #679
Related epics: #536, #631

Evidence

news_portal imports blog-content application/domain code, while blog_content imports news-portal application/domain code. Module descriptors do not expose this runtime coupling, so the dependency graph looks healthier than the source graph.

Objective

Establish one-way, explicit module collaboration through capability ports and a composition root.

Scope

• Inventory every cross-import between src/modules/blog-content and src/modules/news-portal.
• Define provider-neutral ports/DTOs for the minimum shared capabilities.
• Declare required versus optional capability dependencies in module metadata.
• Wire adapters in the application composition root, not inside domain modules.
• Add a source-boundary check that rejects undeclared cross-module imports.
• Preserve public route and editorial behavior.

Out of scope

• Merging the two modules.
• Rewriting blog/news product scope.
• Adding runtime plugin loading.

Acceptance criteria

• No application/domain file in either module imports the other's implementation directly.
• Optional news behavior degrades safely when the capability is unavailable.
• Module descriptors accurately represent required/optional capabilities.
• Boundary tests fail on forbidden imports.
• Existing blog/news unit and integration tests pass.
• ADR/module docs explain the chosen dependency direction.