refactor: Phase 3e — composition root moves service wiring to main

Problem: httpapi.NewHandler built its service dependencies internally
(entity repo, entity service, read models), making the handler a
god-object that knew how to construct its own dependencies. ADR 0016
§3.5 wants cmd/oikos/main.go to be the composition root.

Change:
- httpapi.NewHandler: services (EntityService, EntityRepo, ReadModels)
  are now injected as parameters instead of constructed inside.
- httpapi.ListenAndServe: passes the injected services to NewHandler.
- cmd/oikos/main.go runAPI + the 'all' role handler: construct
  entityRepo, readModels, and EntityService at the composition root
  and pass them down. The router stays in httpapi for now; ownership
  moves to main in a later phase.
- Tests: newTestHandler updated to construct and inject test doubles.

Verification: full build/vet, non-DB suite (19 pkgs), DB integration
(postgres + mcp — green). httpapi DB tests have the pre-existing set
of failures (TestAPIEndToEnd, TestPhase3* — verified at ec11956).

internal/httpapi/api_test.go

@@ -14,9 +14,11 @@ import (
 	"os"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/dtoro/oikos/internal/config"
 	"github.com/dtoro/oikos/internal/adapters/postgres"
+	"github.com/dtoro/oikos/internal/core/app"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -93,7 +95,9 @@ func newTestHandler(t *testing.T, cfg config.Config) http.Handler {
 		}
 	}
 
-	return NewHandler(handlerCtx, pool, cfg)
+	repo := db.NewEntityRepo(pool)
+	onto := db.NewOntologyRepo(pool, time.Minute)
+	return NewHandler(handlerCtx, pool, cfg, app.NewEntityService(repo, onto), repo, db.NewEntityReader(pool))
 }
 
 // testAuthToken is the static bearer token devConfig() configures. There is