ASP.NET Core Identity is backed by an in-memory database (since 11.1.0); the only allowed login method is via Microsoft account, but DeviantArt and Reddit accounts can be added in user management (which will connect these accounts to Pandacap's main database).
Does this literally mean I need a Microsoft account to run this on my own machine, or is that only for deploying on Azure?
Are you aware of sonarqube?
It does the complexity and best practices parts of your list, and can be plugged into continuous delivery systems. Jetbrains' IDEs have a free plugin that will run it locally, and I would be surprised if similar integrations didn't exist for (neo)vim, vs-code, etc.
It's pretty decent at explaining why it considers a chunk of code to be problematic, and can even propose quick fixes as if it were an LSP.
You can also flag issues it finds as "intended/deemed non-fixable by the dev(s)".