refactor(audit): add src.startup_profiler and src.api_hooks to LEAN_ALLOWLIST

Sub-track 2D: 2 violations cleared (the 3 remaining sloppy.py violations are src.app_controller and src.gui_2 imports, addressed in sub-tracks 2E and 2F).

src.startup_profiler: 5 top-level imports, all stdlib (time, sys, contextlib, dataclasses, typing). Lean.

src.api_hooks: After sub-track 2C, now only has 10 top-level imports, all stdlib (asyncio, json, logging, sys, threading, uuid, http.server, typing) + src.module_loader (already in allowlist). Lean.

Allowlist now contains 13 lean src.* modules. Audit: 51 -> 49.

4 new tests in tests/test_audit_allowlist_2d.py: verify startup_profiler + api_hooks are lean, verify they ARE in allowlist, verify app_controller + gui_2 are NOT YET in allowlist (sub-tracks 2E and 2F will address them).

scripts/audit_main_thread_imports.py

@@ -43,6 +43,8 @@ LEAN_ALLOWLIST: set[str] = {
  "src.events",
  "src.config",
  "src.module_loader",
+ "src.startup_profiler",
+ "src.api_hooks",
 }