refactor: rombak arsitektur file ke modular clean-arch (vertikal per-feature)

Organisasi ulang layer-first (domain/application/infrastructure) menjadi
vertikal per-feature, behavior tidak berubah:

- src/shared/domain/  -> fondasi bersama (ex-domain/core): message, provider,
  tool_call, tool_result, store, error, usage, conversation
- src/features/agent/ -> LLM turn loop: domain (TurnEvent, AgentTurnParams) +
  application (turn_service, ports) + infrastructure (llm LlmClient + tools)
- src/features/cms/   -> settings/conversation/memory persistence: domain +
  application (services) + infrastructure (persistence repos)
- src/features/subagent/ -> orchestration: domain (AccessTier) + infrastructure
  (engine runner, context, provider, delegate, spawn_tools)
- src/features/workflow/ -> multi-phase + hive-mind: domain + infrastructure
- src/interfaces/     -> cli + tui (outer ring) tetap

Subagent-runner (engine.ts runAgent, division.ts toolsFor) dipindah ke
features/subagent (bukan agent tools) utk memutus coupling agent<->subagent.

Alias tsconfig: @zesdex/domain -> shared/domain, + @zesdex/agent,
@zesdex/agent-infra, @zesdex/cms, @zesdex/subagent, @zesdex/workflow, @zesdex/shared.
Bersihkan dead: application/ports PasswordService/TokenService/AuthService.
compose.ts (composition root) & bootstrap repoint ke barrel feature.

Gates: tsc --noEmit 0 error, bun test 70 pass/0 fail, bun build 147 modules,
./dist/zesdex --headless -> real turn OK.

src/features/agent/infrastructure/tools/mod.ts

@@ -0,0 +1,42 @@
+/**
+ * Tool trait, execution context, and the registry of all built-in tools.
+ * Mirrors `apps/infrastructure/src/tools/mod.rs`.
+ */
+import type { JsonValue } from "@zesdex/domain";
+import type { ToolCtx } from "./context.ts";
+
+// ── Re-export framework modules ──────────────────────────────────────────
+export type { GraduatedCheck, ToolCtx } from "./context.ts";
+export { ToolCtxBuilder } from "./context.ts";
+export {
+  argStr,
+  resolvePath,
+  logWriteEditTool,
+  sha256Hex,
+} from "./util.ts";
+export {
+  checkGraduatedChecks,
+} from "./graduated.ts";
+export {
+  checkGitDestructive,
+} from "./shell/git.ts";
+export {
+  isCredentialPath,
+  checkCredentialRead,
+} from "./shell/credentials.ts";
+export {
+  allTools,
+  toolDefs,
+  toolIsRisky,
+  toolIsParallelSafe,
+} from "./registry.ts";
+
+// ── Tool interface ───────────────────────────────────────────────────────
+
+/** Common interface every agent-invocable tool implements. */
+export interface Tool {
+  name: string;
+  description: string;
+  parameters: Record<string, unknown>;
+  run(ctx: ToolCtx, args: JsonValue): string | Promise<string>;
+}