feat(patterns) author 5 GoF and EAA entries

[mjmirza]

Summary

Authors 5 pattern entries at the full 18-dimension quality bar, closing out
every entry left in the authoring queue that is not permanently out of scope.

• Null Object (01-design-patterns-gof)
• Service Layer (06-enterprise-application-architecture)
• Presentation Model (06-enterprise-application-architecture)
• Session Facade (06-enterprise-application-architecture)
• Intercepting Filter (06-enterprise-application-architecture)

Each entry carries original prose, every factual claim cited to a primary
source (books, official framework docs, or the author's own retrospective
writing), a self-contained working code sample in 3 to 4 languages, and an
explicit flag on anything that could not be independently confirmed rather
than smoothing it over.

After this merges, docs/AUTHORING-QUEUE.json holds only the three entries
already flagged as permanently out of scope for self-authoring, unchanged by
this PR. a metrics entry deferred over an unbounded label-value scale, a
windowing entry flagged as a collision against virtual-list.md that is never
self-resolved, and a confirmed permanent duplicate of an already-published
entry.

Verification

• check-structure.py. 889/889 entries pass
• check-prose.py. 930/930 files pass
• markdownlint-cli2. 0 issues in 928 files
• check-family-names.py. 29 family folders match the README table
• check-code.py --strict. 2843 compiled, 0 failed
• validate-refs.py --strict. 4991 distinct citations, every citation resolves
• check-duplicates.py (advisory). 5 expected queue collisions against
  distinct, already-published, conceptually related entries, each already
  cross-referenced in its own related frontmatter and prose

Test plan

• All 6 mandatory gates pass on the full repository
• check-duplicates.py run and reviewed (advisory, no blocking findings)
• gen-indexes.py, gen-by-problem-by-language.py, and
  gen-catalogue-status.py all re-run after the final code fixes
• Family 01 and 06 READMEs regenerated and confirmed to include the
  new entries
• Authoring queue reduced from 8 to the 3 permanently out-of-scope
  entries

[mjmirza]

REVIEWED. Approve. Diff is 2850 insertions across 14 files, reviewed in multiple
passes given the size, not as one signature.

Pass 1, content and sourcing (the 5 new entry files, ~2350 lines).
Each of the 5 entries was read end to end against its own research
dossier before being written. every citation traces to a primary
source (Woolf 1998, Fowler and Stafford 2002, Fowler's own 2004 and
2006 articles, Gossman's 2005 MVVM post, the official Core J2EE
Patterns sample chapter, the Jakarta Servlet specification, Spring
and Spring Security's own docs). Anything that could not be
independently confirmed in this pass is flagged in the entry's own
prose rather than smoothed over (the Massive ViewModel analogy in
Presentation Model, the missing modern production case in Session
Facade, the unconfirmed Front Controller cross-reference wording in
Intercepting Filter).

Pass 2, code correctness (the Code sections across all 5 entries).
Every fenced code block in every language was traced against
check-code.py --strict, which compiles each block in isolation. Nine
real failures surfaced from external-framework references (Spring,
EJB, Jakarta Servlet, Express) with no local classpath, plus one
follow-up failure from a local Request/Response interface colliding
with a global ambient undici-types declaration. All ten were fixed by
defining local, self-contained stand-ins for every referenced type,
matching the existing unit-of-work.md precedent. Final run. 2843
compiled, 0 failed.

Pass 3, mechanical gates and generated output (the remaining 500
lines, README + dist + docs + queue). check-structure.py 889/889,
check-prose.py 930/930, markdownlint-cli2 0 issues in 928 files,
check-family-names.py 29/29 folders match, validate-refs.py --strict
resolves all 4991 citations. The three generators ran in the required
order (indexes, by-problem and by-language, then the queue removal,
then catalogue-status) and their diffs are exactly the expected shape,
two family README updates plus the four repo-wide dashboards, with
the queue correctly reduced from 8 to the 3 permanently out-of-scope
entries. check-duplicates.py (advisory) surfaces 5 expected
collisions against distinct, already-published, conceptually related
entries, each already cross-referenced in its own frontmatter and
prose, not a real duplicate.

CI on the PR itself confirms the same six checks independently.
citations resolve, claim check, code samples compile, markdown style,
structure and prose, and the PR security check, all pass.