arch: IAccountRepository.FindBySlugAsync is a cross-farm read on Farm's seam with no caller guard #1053

IAccountRepository.FindBySlugAsync is a cross-farm read: it ignores query filters and returns the full Account entity for any farm code. It sits on Farm's seam, which every peer module may take, and no caller guard covers it.

Proven by mutant O5 in the Opus security review on #1043. CreateProductHandler, which already holds IAccountRepository, gained await accounts.FindBySlugAsync("another-farm", ct). All 12 relevant guards stayed green.

Today only IdentityProvider (login) calls it, so nothing leaks. The gap is that nothing stops the next caller.

Done when: callers of the cross-farm member are restricted the way #1043's FarmDirectoryCallerTests restricts IFarmDirectory. Either:

• move it behind IFarmDirectory or an Access-owned login port; or
• add a caller guard that allows only login, parses with ModuleLedgerScanner.ParseOptions, and is proven with the O5 mutant.

Related: #858 P8 (ledger end state) and #1023.