Refactor error handling in IAM and CMS crates

- Introduced `RepositoryError` and `ServiceError` enums in both IAM and CMS domains for better error management.
- Updated domain traits and services to return specific error types instead of `anyhow::Result`.
- Enhanced session and OAuth repository implementations to handle errors more explicitly.
- Refactored session service methods to return `Result<T, ServiceError>` for improved error handling.
- Updated HTTP handlers to utilize the new error types.
- Modified password hashing functions to run in a blocking context using `tokio::task::spawn_blocking`.
- Added tests for new error handling mechanisms and async password functions.

crates/zesdex-iam/src/domain/service.rs

@@ -8,19 +8,20 @@
 //!
 //! - [`SessionService`] — create, list, archive sessions
 //! - [`OAuthService`] — start PKCE flow, complete code exchange, retrieve token
+use crate::domain::error::ServiceError;
 use crate::domain::oauth::{OAuthConfig, OAuthToken};
 use crate::domain::session::Session;
 
 /// Session management use-case boundary.
 pub trait SessionService {
     /// Create a new session with a generated UUID and the given title.
-    fn create_session(&self, title: &str) -> anyhow::Result<Session>;
+    fn create_session(&self, title: &str) -> Result<Session, ServiceError>;
 
     /// List all available sessions.
-    fn list_all(&self) -> anyhow::Result<Vec<Session>>;
+    fn list_all(&self) -> Result<Vec<Session>, ServiceError>;
 
     /// Archive a session by id (sets `archived = true`).
-    fn archive_session(&self, id: &str) -> anyhow::Result<()>;
+    fn archive_session(&self, id: &str) -> Result<(), ServiceError>;
 }
 
 /// OAuth flow use-case boundary.
@@ -34,7 +35,7 @@ pub trait OAuthService {
         &self,
         config: &OAuthConfig,
         redirect_uri: &str,
-    ) -> anyhow::Result<(String, String)>;
+    ) -> Result<(String, String), ServiceError>;
 
     /// Complete the OAuth flow: validates `state` against the value
     /// persisted during `start_flow` (bailing on mismatch — this is the
@@ -46,8 +47,8 @@ pub trait OAuthService {
         redirect_uri: &str,
         code: &str,
         state: &str,
-    ) -> anyhow::Result<OAuthToken>;
+    ) -> Result<OAuthToken, ServiceError>;
 
     /// Retrieve the currently stored OAuth token (if any).
-    fn get_token(&self) -> anyhow::Result<Option<OAuthToken>>;
+    fn get_token(&self) -> Result<Option<OAuthToken>, ServiceError>;
 }