docs: tambah doc comment, logging, dan inline comments di semua 255 file

Meliputi:
- File-level //! doc comment: tujuan file, alur kerja, komponen utama
- Function-level /// doc comment: apa, parameter, return, flow, edge cases
- Struct/enum/trait /// doc comment: peran, field docs
- Tracing logging (tracing::info!/debug!/trace!/warn!/error!) di setiap fungsi
- Inline comments untuk variable dan branching logic penting
- Seluruh 8 crates di workspace: zesdex-backend, zesdex-cms, zesdex-entities,
  zesdex-iam, zesdex-infra, zesdex-ipc, zesdex-middleware, zesdex-utils
- Build: 0 errors, 242/242 tests passed

crates/zesdex-iam/src/infrastructure/oauth_loopback.rs

@@ -2,13 +2,31 @@
 //!
 //! Ported from `zesdex-backend::service::oauth::loopback` to centralise OAuth
 //! primitives in the `zesdex-iam` crate.
+//!
+//! # Flow
+//!
+//! 1. [`LoopbackServer::bind`] — bind to `127.0.0.1:0` (OS-assigned port).
+//! 2. [`redirect_uri`](LoopbackServer::redirect_uri) — caller gets the full
+//!    `http://127.0.0.1:<port>/callback` URI to pass to `start_flow`.
+//! 3. [`wait_for_code`](LoopbackServer::wait_for_code) — block until browser
+//!    redirect hits the loopback → parse `?code=` and `?state=` from the HTTP
+//!    request line → validate state → respond with 200/400 → return the code.
+//!
+//! # Components
+//!
+//! - `LoopbackServer` — single-use TCP listener for one OAuth callback
+//! - `wait_for_code` / `read_callback` / `extract_code` / `extract_state`
+//! - `urlencoding` — minimal percent-decoder for query parameters
 use std::io::{Read, Write};
 use std::net::{TcpListener, TcpStream};
+use tracing;
 
 /// A single-use HTTP listener on `127.0.0.1` that receives the OAuth
 /// `?code=...` redirect and serves back a static confirmation page.
 pub struct LoopbackServer {
+    /// The bound TCP listener (accepts one connection per `wait_for_code` call).
     listener: TcpListener,
+    /// The OS-assigned port number.
     port: u16,
 }
 
@@ -19,6 +37,7 @@ impl LoopbackServer {
     pub fn bind() -> std::io::Result<Self> {
         let listener = TcpListener::bind("127.0.0.1:0")?;
         let port = listener.local_addr()?.port();
+        tracing::debug!(port, "loopback server bound");
         Ok(LoopbackServer { listener, port })
     }
 
@@ -37,6 +56,7 @@ impl LoopbackServer {
     /// Return: `Err(InvalidData)` if no `code` param is present or the state
     /// doesn't match `expected_state`.
     pub fn wait_for_code(&self, timeout_ms: u64, expected_state: &str) -> std::io::Result<String> {
+        tracing::debug!(port = self.port, timeout_ms, "waiting for OAuth callback");
         let (mut stream, _) = self.listener.accept()?;
         stream.set_read_timeout(Some(std::time::Duration::from_millis(timeout_ms)))?;
         Self::read_callback(&mut stream, expected_state)