[14] feat(flags): model cross-stack feature flags

[fernandofielmann]

Goal

Provide an explicit cross-stack view of literal feature-flag definitions and reads without relying on global string similarity.

Scope

• Create FeatureFlag nodes keyed by an exact literal flag key.
• Emit DEFINES_FLAG and READS_FLAG from configuration, constants, guards, services, and templates.
• Start with literal IConfiguration/IOptions access and literal frontend flag-service access.
• Use provider, guard, template, and contract context to improve evidence without evaluating runtime configuration.
• Preserve source stack, access kind, and evidence on relationships.
• Omit computed keys, broad configuration sections, and ambiguous aliases.
• Add an explicit flag trace before including these edges in broader trace modes.

Dependencies

• Depends on: [06] feat(angular): model route guards #13 ([06] Angular guards), [08] feat(dotnet): model dependency injection registrations #15 ([08] .NET DI), [10] feat(angular): extract template control flow #17 ([10] template control flow), and [13] feat(contracts): match TypeScript and CSharp HTTP contracts #20 ([13] TypeScript/C# contracts).
• This is the final roadmap capability and should begin only after all dependencies are stable.

Acceptance criteria

• Identical literal keys converge on one project-scoped/cross-stack FeatureFlag identity.
• Definitions and reads retain source, stack, and access-kind metadata.
• Computed/dynamic keys do not create guessed flag nodes.
• Unrelated identical strings outside supported flag APIs do not match.
• Explicit traces can show backend definition/read and frontend guard/service/template reads.
• Sequential and parallel pipelines produce equivalent nodes and edges.
• MCP schema, trace modes, graph contracts, and README document the model.

Validation

• Add backend/frontend literal, configuration binding, guard, template, dynamic-key, false-string-match, ambiguity, deduplication, and parity fixtures.
• Run Angular, .NET, template, contract, trace, and convergence suites, lint-ci, and scripts/test.sh.
• Validate privately without publishing repository-specific names or code.