Refactor error handling in IAM and CMS crates

- Introduced `RepositoryError` and `ServiceError` enums in both IAM and CMS domains for better error management.
- Updated domain traits and services to return specific error types instead of `anyhow::Result`.
- Enhanced session and OAuth repository implementations to handle errors more explicitly.
- Refactored session service methods to return `Result<T, ServiceError>` for improved error handling.
- Updated HTTP handlers to utilize the new error types.
- Modified password hashing functions to run in a blocking context using `tokio::task::spawn_blocking`.
- Added tests for new error handling mechanisms and async password functions.

crates/zesdex-backend/src/app/util/backoff.rs

@@ -3,6 +3,7 @@
 //! Three use cases (subagent, provider, workflow) all share the same formula
 //! with different caps.  This module provides a single implementation.
 
+use std::convert::TryInto;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 /// Compute an exponential backoff with ±25% jitter.
@@ -27,9 +28,9 @@ pub fn backoff_seconds(attempt: u32, max_secs: u64) -> Duration {
 /// Uses sub-nanosecond wall-clock bits as a cheap PRNG source — no
 /// need for a full RNG for ±25% backoff jitter.
 fn jitter_ns(range_ns: u64) -> u64 {
-    let nanos = SystemTime::now()
+    let dur = SystemTime::now()
         .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_nanos() as u64;
+        .unwrap_or_default();
+    let nanos: u64 = dur.as_nanos().try_into().unwrap_or(u64::MAX);
     nanos % range_ns
 }