Make v2 file-layer exceptions expire and cover whole files #4204

Problem

#4191 added the v2-layers quality guard and rule api.v2.files-assigned-to-layers, which requires every file under policyengine_api/services/v2 and policyengine_api/fastapi_routes/v2 to have a name that gives it a layer. A file that can't be renamed may instead be listed in a [[rule.exception]] for that rule in rules/registry.toml.

#4191 merged before the fixes from its last self-review round, so the guard on master still accepts exceptions that it shouldn't, and some of its messages and proofs are incomplete:

1. Exceptions with no expiry date. An exception that sets category = "forever" or removal = "never" and no expires date loads, passes the registry checks and is accepted by the guard. The file then keeps a name with no layer permanently.
2. match is ignored. An exception with a match field reads as if it covered one site, but the guard applies it to the whole file.
3. Exceptions for connector files. The guard accepts an exception for a misnamed module in a database_connectors package, but rule api.v2.crud-checks-cover-every-resource still fails that module, so the exception can't work.
4. Incomplete fix message. The message for a services file with no layer lists the allowed names but not where each must sit (for example, database_session.py only directly in a resource package), so following it can fail again.
5. Proof gap. The registered proof fixture for api.v2.files-assigned-to-layers has no unassigned file under fastapi_routes/v2, so the proof doesn't show that check working there.

Proposed fix

• Report a files-rule exception that sets category, removal or match, that has no expires date, or that names a database_connectors module.
• Give the services fix message each name's location, and give connector modules their own message.
• Add an unassigned route file to the proof fixture.
• Split the guard so that each module stays under the 800-line limit.