build(cmake): fix yyjson REQUIRED gating + link/include order

Code review of 4762b56 flagged two issues in service/CMakeLists.txt:

1. Critical — pkg_check_modules(yyjson REQUIRED yyjson) was inside
   `if(PKG_CONFIG_FOUND)`, so a missing pkg-config would silently skip
   the REQUIRED check and the binary would link with empty
   ${yyjson_LIBRARIES} (i.e., no yyjson). Promote find_package(PkgConfig)
   to REQUIRED and move the yyjson probe out of the conditional. LZ4 and
   jemalloc remain QUIET-optional but now run unconditionally too —
   acceptable since they tolerate FOUND=0 internally.

2. Important — yyjson's target_include_directories preceded its
   target_link_libraries, inverting the file's convention (LZ4 line 81/82
   and jemalloc 91/92 both link-first-then-include). Swap to match.

service/CMakeLists.txt

@@ -3,22 +3,28 @@
 # Find OpenSSL for encryption
 find_package(OpenSSL REQUIRED)
 
-# Find optional LZ4 for compression
-find_package(PkgConfig)
-if(PKG_CONFIG_FOUND)
-    pkg_check_modules(LZ4 QUIET liblz4)
-    pkg_check_modules(yyjson REQUIRED yyjson)
-    # v1.9.4 — jemalloc replaces glibc malloc for the smartbotic-database
-    # binary. The fragmentation pattern from per-RPC nlohmann::json node
-    # churn (107k 33-byte allocations observed on Zoe) defeats glibc's
-    # malloc_trim because the trailing region of each arena always has a
-    # live chunk; jemalloc's background-thread dirty-page decay sidesteps
-    # the contiguity requirement and reclaims unused pages on a wallclock
-    # timer regardless of allocation activity. Linked as a library so
-    # the binary picks up jemalloc's malloc/free symbols at link time;
-    # no LD_PRELOAD needed.
-    pkg_check_modules(JEMALLOC QUIET jemalloc)
-endif()
+# PkgConfig is REQUIRED because yyjson (v1.10+) is a hard build dependency.
+# LZ4 and jemalloc remain optional, but if pkg-config itself is missing we
+# fail at configure time rather than silently producing a yyjson-free binary
+# via empty ${yyjson_LIBRARIES} expansion.
+find_package(PkgConfig REQUIRED)
+
+# yyjson — phase A v1.10 hot-path JSON parser. Hard dependency.
+pkg_check_modules(yyjson REQUIRED yyjson)
+
+# Optional LZ4 for compression
+pkg_check_modules(LZ4 QUIET liblz4)
+
+# v1.9.4 — jemalloc replaces glibc malloc for the smartbotic-database
+# binary. The fragmentation pattern from per-RPC nlohmann::json node
+# churn (107k 33-byte allocations observed on Zoe) defeats glibc's
+# malloc_trim because the trailing region of each arena always has a
+# live chunk; jemalloc's background-thread dirty-page decay sidesteps
+# the contiguity requirement and reclaims unused pages on a wallclock
+# timer regardless of allocation activity. Linked as a library so
+# the binary picks up jemalloc's malloc/free symbols at link time;
+# no LD_PRELOAD needed.
+pkg_check_modules(JEMALLOC QUIET jemalloc)
 
 # Source files
 set(DATABASE_SERVICE_SOURCES
@@ -82,8 +88,9 @@ if(LZ4_FOUND)
     target_include_directories(smartbotic-database PRIVATE ${LZ4_INCLUDE_DIRS})
 endif()
 
-target_include_directories(smartbotic-database PRIVATE ${yyjson_INCLUDE_DIRS})
+# yyjson — phase A v1.10 hot-path JSON parser
 target_link_libraries(smartbotic-database PRIVATE ${yyjson_LIBRARIES})
+target_include_directories(smartbotic-database PRIVATE ${yyjson_INCLUDE_DIRS})
 
 # v1.9.4 — jemalloc allocator (overrides glibc malloc/free)
 if(JEMALLOC_FOUND)