✨ feat: Add named capture in module patterns for back-referencing in allow/deny

[heumsi]

Summary

• Add {name} capture syntax in modules patterns that can be back-referenced in allow/deny rules
• Enables cross-context isolation without duplicating per-context rules (e.g., Hexagonal Architecture with multiple Bounded Contexts)
• Fully backward compatible — existing configs work without changes

Example

rules:
  - name: domain-layer
    modules: contexts.{context}.domain
    allow:
      local: [contexts.{context}.domain, shared.domain]

When matching contexts.boards.domain, {context} captures "boards", so only contexts.boards.domain is allowed — not contexts.auth.domain.

Changes

• matcher.py: Add match_pattern_with_captures(), update find_matching_rules() to return captures
• checker.py: Add resolve_captures(), update check_import() with optional captures parameter
• cli.py: Thread captures from rule matching to import checking
• README.md: Add Named Capture documentation section, update Hexagonal Architecture example
• 22 new tests (75 total, all passing)

Closes #16

Test plan

• Unit tests for match_pattern_with_captures (single/multiple captures, duplicate name consistency, coexistence with */**, backtracking)
• Unit tests for resolve_captures (single/multiple/no placeholders, unresolved placeholders)
• Integration tests for cross-context isolation (allowed and violation cases)
• Backward compatibility test (existing behavior without captures)
• All 75 tests pass
• ruff lint clean

🤖 Generated with Claude Code