The direction of the dependency is load-bearing
Apache-2.0 is one-way compatible with AGPL-3.0: an AGPL work may include Apache-2.0 code, never the reverse. So the host may depend on the engine, and the engine must never import from `apps/`. That was already true architecturally, because the Station is specified as a privileged client of the engine rather than an extension. The license split makes the same boundary a legal one, which means a violation is no longer only a design smell.