feat: replace Claude-based extraction with a rule-based engine

Deklarix itself no longer depends on the Anthropic API — that was a
separate API key/billing relationship from Claude Code (used to develop
Deklarix), which the user did not intend to take on for the product
itself.

Consideration (Gegenleistung) is no longer guessed from text — it's a
required form field now, since only the submitter actually knows
whether a business relationship existed. A keyword-only system can't
tell a covertly-paid post from a genuinely organic one; they read
identically. What internal/extract *can* still determine reliably and
deterministically from the caption: whether a disclosure keyword is
present (werbung, anzeige, bezahlte partnerschaft, paid partnership,
#ad, #werbung, #anzeige, #sponsored, #sponsoredby, #sponsoredpost —
case-insensitive), its exact original-case wording, and whether it sits
before the platform's "mehr anzeigen" truncation point (~125 chars
Instagram, ~150 TikTok — rough estimates, platforms change these without
notice, verify before real customer use).

internal/extract's Anthropic HTTP client and tool-use schema are gone
(client.go/api.go deleted), replaced by engine.go — a stateless Engine
with no network calls. extract.Result/ParsePayload keep the exact same
JSON shape as before (gegenleistung/kennzeichnung_vorhanden/
kennzeichnung_wortlaut/kennzeichnung_vor_kuerzung), so internal/store and
internal/dossier needed no changes at all — only extract itself, the web
form/handler (new consideration field), and main.go (no more
ANTHROPIC_API_KEY requirement) changed.

Trade-off the user was told and accepted: without an LLM, the system can
no longer independently catch undisclosed paid content that carries no
recognizable keyword at all — that now rests on the submitter's honesty.
Creative or implicit disclosure phrasing outside the keyword list also
won't be recognized.

Verified against a real running instance with zero API keys configured:
register -> check (real rule engine, correctly triggered WK-004 for a
disclosure placed 130 characters in, past the Instagram threshold) ->
archive -> PDF dossier download, all against real Postgres.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/handlers.go

@@ -60,8 +60,9 @@ func (s *Server) handleCheck(w http.ResponseWriter, r *http.Request) {
 	platform := r.FormValue("platform")
 	postType := r.FormValue("post_type")
 	caption := r.FormValue("caption")
-	if platform == "" || postType == "" || caption == "" {
-		http.Error(w, "Plattform, Beitragstyp und Caption sind Pflichtfelder", http.StatusBadRequest)
+	consideration := r.FormValue("consideration")
+	if platform == "" || postType == "" || caption == "" || consideration == "" {
+		http.Error(w, "Plattform, Beitragstyp, Gegenleistung und Caption sind Pflichtfelder", http.StatusBadRequest)
 		return
 	}
 
@@ -69,9 +70,10 @@ func (s *Server) handleCheck(w http.ResponseWriter, r *http.Request) {
 	accountID := currentUser(r).AccountID
 
 	result, err := s.extractor.Extract(ctx, extract.Input{
-		Platform:     platform,
-		Jurisdiction: "DE",
-		Caption:      caption,
+		Platform:      platform,
+		Jurisdiction:  "DE",
+		Consideration: consideration,
+		Caption:       caption,
 	})
 	if err != nil {
 		http.Error(w, "Extraktion fehlgeschlagen: "+err.Error(), http.StatusBadGateway)

internal/web/server.go

@@ -26,8 +26,9 @@ var templatesFS embed.FS
 var staticFS embed.FS
 
 // Extractor ist die Schnittstelle, die der Server für Stufe 1 braucht.
-// *extract.Client erfüllt sie; Tests injizieren einen Fake statt echte
-// Claude-API-Aufrufe zu machen.
+// *extract.Engine erfüllt sie (regelbasiert, kein externer Dienst);
+// Tests injizieren einen Fake, um Facts unabhängig von der echten
+// Erkennungslogik vorzugeben.
 type Extractor interface {
 	Extract(ctx context.Context, in extract.Input) (extract.Result, error)
 	ModelVersion() string

internal/web/server_test.go

@@ -373,7 +373,10 @@ func getWithCookie(t *testing.T, s *web.Server, cookie *http.Cookie, path string
 }
 
 func checkForm(extra ...string) url.Values {
-	v := url.Values{"platform": {"instagram"}, "post_type": {"reel"}, "caption": {"..."}}
+	v := url.Values{
+		"platform": {"instagram"}, "post_type": {"reel"},
+		"consideration": {"bezahlt"}, "caption": {"Werbung: ..."},
+	}
 	for i := 0; i+1 < len(extra); i += 2 {
 		v.Set(extra[i], extra[i+1])
 	}

internal/web/templates/index.html

@@ -21,6 +21,19 @@
     <option value="video">Video</option>
   </select>
 
+  <label for="consideration">Gegenleistung</label>
+  <select id="consideration" name="consideration" required>
+    <option value="">— bitte wählen —</option>
+    <option value="bezahlt">Bezahlt</option>
+    <option value="sachbezug">Sachbezug (Produkt, Einladung, ...)</option>
+    <option value="keine">Keine</option>
+    <option value="unklar">Unklar</option>
+  </select>
+  <p class="hinweis">
+    Das kann die Prüfung nicht aus der Caption erraten — nur wer
+    einreicht, weiß, ob eine Gegenleistung vorlag.
+  </p>
+
   <label for="caption">Caption</label>
   <textarea id="caption" name="caption" rows="6" required></textarea>