refactor: Phase 3e — composition root moves service wiring to main

Problem: httpapi.NewHandler built its service dependencies internally
(entity repo, entity service, read models), making the handler a
god-object that knew how to construct its own dependencies. ADR 0016
§3.5 wants cmd/oikos/main.go to be the composition root.

Change:
- httpapi.NewHandler: services (EntityService, EntityRepo, ReadModels)
  are now injected as parameters instead of constructed inside.
- httpapi.ListenAndServe: passes the injected services to NewHandler.
- cmd/oikos/main.go runAPI + the 'all' role handler: construct
  entityRepo, readModels, and EntityService at the composition root
  and pass them down. The router stays in httpapi for now; ownership
  moves to main in a later phase.
- Tests: newTestHandler updated to construct and inject test doubles.

Verification: full build/vet, non-DB suite (19 pkgs), DB integration
(postgres + mcp — green). httpapi DB tests have the pre-existing set
of failures (TestAPIEndToEnd, TestPhase3* — verified at ec11956).

cmd/oikos/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"time"
 	"context"
 	"fmt"
 	"log/slog"
@@ -11,6 +12,7 @@ import (
 	"syscall"
 
 	"github.com/dtoro/oikos/internal/config"
+	"github.com/dtoro/oikos/internal/core/app"
 	"github.com/dtoro/oikos/internal/adapters/postgres"
 	"github.com/dtoro/oikos/internal/execworker"
 	"github.com/dtoro/oikos/internal/httpapi"
@@ -109,8 +111,13 @@ func main() {
 		go schedulerRunner(ctx, pool, cfg)
 		go execWorkerRunner(ctx, pool, cfg)
 
+		// Build composition-root dependencies (ADR 0016).
+		entityRepo := db.NewEntityRepo(pool)
+		readModels := db.NewEntityReader(pool)
+		entities := app.NewEntityService(entityRepo, db.NewOntologyRepo(pool, time.Minute))
+
 		slog.Info("all: starting api with scheduler + execution-worker in background")
-		if err := httpapi.ListenAndServe(ctx, pool, cfg); err != nil {
+		if err := httpapi.ListenAndServe(ctx, pool, cfg, entities, entityRepo, readModels); err != nil {
 			slog.Error("api failed", "error", err)
 			os.Exit(1)
 		}
@@ -288,7 +295,12 @@ func runAPI(ctx context.Context, cfg config.Config) error {
 		return fmt.Errorf("migrations: %w", err)
 	}
 
-	err = httpapi.ListenAndServe(ctx, pool, cfg)
+	// Composition root — build the service dependencies (ADR 0016, plan §3.5).
+	entityRepo := db.NewEntityRepo(pool)
+	readModels := db.NewEntityReader(pool)
+	entities := app.NewEntityService(entityRepo, db.NewOntologyRepo(pool, time.Minute))
+
+	err = httpapi.ListenAndServe(ctx, pool, cfg, entities, entityRepo, readModels)
 	if err == http.ErrServerClosed {
 		return nil
 	}