[OPIK-6891] [BE] test: guard the trace deletion-events bridge with ArchUnit (#7390)

Add an ArchUnit architectural test asserting that only TraceServiceImpl may call
TraceDAO.delete, so a future refactor adding a new trace-delete path can't
silently bypass the deletion-events bridge capture. Retention paths are separate
methods and intentionally out of scope.

Introduce ArchUnit (archunit-junit5 1.4.2 — bundles ASM with Java 25 support) as
a test dependency.

Author: andrescrz

apps/opik-backend/pom.xml

@@ -451,6 +451,12 @@
             <artifactId>testcontainers-junit-jupiter</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>com.tngtech.archunit</groupId>
+            <artifactId>archunit-junit5</artifactId>
+            <version>1.4.2</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>uk.co.jemos.podam</groupId>
             <artifactId>podam</artifactId>

apps/opik-backend/src/test/java/com/comet/opik/domain/TraceDeletionEventArchTest.java

@@ -0,0 +1,38 @@
+package com.comet.opik.domain;
+
+import com.tngtech.archunit.core.importer.ImportOption;
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+import io.r2dbc.spi.Connection;
+
+import java.util.Set;
+import java.util.UUID;
+
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+/**
+ * Architectural guard for the trace deletion event capturing. User-initiated trace deletes must flow through
+ * {@link TraceServiceImpl}, which records the deleted ids in {@code deletion_events_local} after the delete so
+ * they survive the data-model migration's table copy. A new caller of
+ * {@code TraceDAO.delete(Set, UUID, Connection)} would issue the lightweight delete without that capture,
+ * silently bypassing the capturing, so this rule fails the build if one appears. Retention paths
+ * ({@code deleteForRetention*}) are intentionally not captured and are separate methods, so they are not matched.
+ */
+@AnalyzeClasses(packages = "com.comet.opik", importOptions = ImportOption.DoNotIncludeTests.class)
+class TraceDeletionEventArchTest {
+
+    /**
+     * allowEmptyShould: this is a negative rule; with zero violations (the healthy state) its should-clause
+     * matches nothing, which ArchUnit otherwise rejects. It still fails if a bypassing caller is introduced.
+     */
+    @ArchTest
+    static final ArchRule trace_deletes_must_route_through_the_capturing_service = noClasses()
+            .that().doNotBelongToAnyOf(TraceServiceImpl.class)
+            .should().callMethod(TraceDAO.class, "delete", Set.class, UUID.class, Connection.class)
+            .because("""
+                    trace deletes must go through TraceServiceImpl so the deletion-events bridge captures every
+                    deleted id; a new caller here would silently bypass the bridge
+                    """)
+            .allowEmptyShould(true);
+}