refactor!: make addrkit a multi-city address normalizer

- remove the events/outages module, ArcGIS adapter, portal config and event statuses
- add a configurable city dictionary/parser and make City part of StreetKey
- seed: read city/city_name, namespace IDs by city, keep structures distinct
- fix reliability: schema v2 with fail-closed load, deterministic ordering,
  input limits, config validation, atomic DB publish, LLM response caps
- add read-only shadow mode comparing the old ES path with addrkit
- breaking: registry.db must be re-seeded; config has no portal section

internal/domain/match/resolver_test.go

@@ -42,6 +42,26 @@ func TestCompatibleVariantProtectsApartment(t *testing.T) {
 	}
 }
 
+// TestCompatibleVariantProtectsCityAndStructure makes sure a rewrite cannot
+// move the address to another city or another building.
+func TestCompatibleVariantProtectsCityAndStructure(t *testing.T) {
+	parser := address.NewParser(address.NewDictionary([]address.City{
+		{Name: "Новосибирск", Aliases: []string{"нск"}},
+		{Name: "Бердск"},
+	}), "")
+	orig := parser.Parse("нск, Сухарная улица 95 стр. 1")
+
+	if !compatibleVariant(orig, parser.Parse("Новосибирск, Сухраная улица 95 стр. 1")) {
+		t.Error("same-city spelling fix must be accepted")
+	}
+	if compatibleVariant(orig, parser.Parse("Бердск, Сухарная улица 95 стр. 1")) {
+		t.Error("city change must be rejected")
+	}
+	if compatibleVariant(orig, parser.Parse("нск, Сухарная улица 95 стр. 2")) {
+		t.Error("structure change must be rejected")
+	}
+}
+
 func TestDamerau(t *testing.T) {
 	if got := damerau("гоглоя", "гоголя"); got != 1 {
 		t.Errorf("transposition distance = %d, want 1", got)