Reverse the core/ -> api/ layering violation in create_app

[tschm]

Subcategory: Overall architecture
Score: 6 → ~8

The package has a clean three-layer intent — data/ → core/ → api/ — and data/ingestion.py correctly imports nothing internal. One edge points the wrong way:

src/pycharting/core/server.py:201, inside create_app, does a function-local import:

from pycharting.api.routes import router as api_router

so the lower core/ layer depends on the upper api/ layer.

Worth noting: api/routes.py imports only data/ingestion, so a top-level import here would not create a cycle. The deferred import is therefore hiding a layering violation rather than breaking one — which is why it is easy to miss in review.

Suggested fix: invert the dependency by injecting the router, e.g. create_app(router: APIRouter | None = None), and let the composing layer (api/ or __init__) supply it. There are no true import cycles in the package today.

done when

No module under src/pycharting/core/ imports from src/pycharting/api/ at either module or function scope, and make test stays green.

Evidence

src/pycharting/core/server.py:201:    from pycharting.api.routes import router as api_router

---

Surfaced by the Rhiza quality gates during the template bump to jebel-quant/rhiza@v1.2.2, which enabled the stricter ruff rule families (ANN, A, BLE, ARG) and TYPECHECKER=both. Gate status at time of filing: make fmt FAIL, make typecheck FAIL, make docs-coverage FAIL, test-layout FAIL; make deptry, make security, make test PASS (154 tests, 100% coverage).