feat(ahrefs): add provider adapters

[iannuttall]

Summary

• Add secure Ahrefs API v3 connect, status, limits, cache, and disconnect flows.
• Implement bounded keyword, domain, competitor, backlink, and referring-domain adapters through the existing provider-neutral contracts.
• Add the authenticated Domain Rating report with required Ahrefs license and attribution evidence.
• Reuse the compact report discovery surface and the single router skill. No provider-specific MCP tool or extra skill was added.
• Add setup docs, report guidance, privacy coverage, synthetic fixtures, and resource tests.

Why

Ahrefs was the remaining provider slice in the external research roadmap. This adds its supported account capabilities without blending provider estimates into Search Console, Google Analytics, crawl, or live result evidence. Domain Rating remains a provider-native supporting metric, not a ranking factor or easy-to-outrank verdict.

Safety and impact

• Credentials stay in the environment, system keychain, or private local fallback and never enter report provenance or cache rows.
• Every paid path is bounded before acquisition and reports request, row, cache, coverage, and API-unit evidence.
• Sparse, missing, partial, capped, and invalid provider states stay distinct.
• Live acceptance used private portfolio sites locally. Their identities and provider payloads are not present in this branch or PR.

Validation

• pnpm build
• pnpm typecheck
• pnpm test
• pnpm lint
• pnpm pack --dry-run
• Clean isolated package install and database smoke tests
• Nine built CLI and MCP smoke commands
• Dependency audit and secret scan, with no vulnerabilities or leaks
• Saved-project domain privacy scan across all 73 committed files
• Private live acceptance across two portfolio sites for Domain Rating, domain overview, ranked keywords, ranking pages, keyword metrics, keyword discovery, SERP competitors, link evidence, cache reuse, invalid input, and the public library adapter
• Synthetic 10,000-row Ahrefs resource harness with bounded acquisition, cache growth, output size, and cleanup