YAML default config & loader

[hiydavid]

Part of #199.

Goal

Land the config foundation: a default YAML, a loader, and merge logic. No persistence or UI yet.

Work

• Add backend/maturity_config_default.yaml with 5 stages and 16 criteria (PR RFC: Configurable maturity scoring system #18 has the full draft)
• Add backend/services/maturity_config.py with:
  • _load_default() (cached YAML load)
  • get_default_config() (returns deep copy)
  • merge_config(base, overrides) — stages replaced wholesale, criteria merged by id, new ids appended
• Add pyyaml to pyproject.toml / requirements.txt
• Tests in tests/test_maturity_config.py:
  • YAML loads, has 5 stages, criteria sum to 100
  • Stage ranges are contiguous and cover 0-100
  • Merge: empty overrides → base; override stages → wholesale replace; override one criterion field → other fields preserved; new criterion id → appended; merge does not mutate base

Acceptance

• pytest tests/test_maturity_config.py passes (~19 tests)
• No public-facing surface yet; this is purely the backend foundation

Files

• backend/maturity_config_default.yaml (new)
• backend/services/maturity_config.py (new)
• tests/test_maturity_config.py (new)
• pyproject.toml, requirements.txt