feat(doi): Repository DoI automated gate and dashboard integration (CUST-WP-0024)

Implements the 14-criterion DoI checklist as a runnable gate with API,
MCP tools, CLI script, and dashboard integration.

Core components:
- api/doi_engine.py — async engine evaluating all 14 criteria (asyncio.to_thread
  for non-blocking HTTP self-calls), shared by API and CLI
- api/schemas/doi.py — DoICriterion, DoIReport, DoISummaryEntry schemas
- api/routers/repos.py — GET /repos/{slug}/doi + GET /repos/doi/summary
- scripts/check_doi.py — CLI: make check-doi REPO=<slug> / check-doi-all
- mcp_server/server.py — check_repo_doi(), get_doi_summary() tools

Dashboard (repos.md):
- DoI tier badge per repo (None/Core/Standard/Full) colour-coded red→green
- Domain block shows lowest DoI tier across its repos
- DoI KPI card in summary row
- DoI filter in All Repos Table
- Link to Repository DoI policy page

Also fixes: TPSC snapshots 500 error (missing nested selectinload for
catalog_entry relationship in list_snapshots endpoint).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

api/routers/tpsc.py

@@ -144,7 +144,9 @@ async def list_snapshots(
     repo_slug: str | None = None,
     session: AsyncSession = Depends(get_session),
 ):
-    q = select(TPSCSnapshot).options(selectinload(TPSCSnapshot.entries))
+    q = select(TPSCSnapshot).options(
+        selectinload(TPSCSnapshot.entries).selectinload(TPSCEntry.catalog_entry)
+    )
     if repo_slug:
         repo = (await session.execute(select(ManagedRepo).where(ManagedRepo.slug == repo_slug))).scalar_one_or_none()
         if not repo: