refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-backend/src/app/mode/settings.rs

@@ -0,0 +1,22 @@
+//! Settings-mode helper logic for the TUI settings overlay.
+//!
+//! Flow: exposes small mutation functions (currently just cycling the
+//! internet access mode) invoked by keybindings while the settings overlay
+//! is active.
+use crate::model::settings::{InternetMode, Settings};
+
+/// Advance the internet access mode to the next value in the cycle.
+///
+/// Flow: Off -> `ReadOnly` -> Full -> Off, wrapping around.
+///
+/// Why: used by a settings-toggle keybinding to step through modes
+/// without needing a dropdown/menu.
+///
+/// Return: nothing; mutates `settings.internet_mode` in place.
+pub fn cycle_internet_mode(settings: &mut Settings) {
+    settings.internet_mode = match settings.internet_mode {
+        InternetMode::Off => InternetMode::ReadOnly,
+        InternetMode::ReadOnly => InternetMode::Full,
+        InternetMode::Full => InternetMode::Off,
+    };
+}