refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-backend/src/model/msglog/blobs.rs

@@ -0,0 +1,61 @@
+//! Binary blob storage in the message-log `SQLite` database (e.g. images,
+//! attachments), keyed by session id and an arbitrary blob key.
+use anyhow::Result;
+use rusqlite::{params, Connection};
+
+/// Insert or overwrite a blob for a session under `blob_key`.
+///
+/// Flow: compute current timestamp -> `INSERT OR REPLACE` into `blobs`
+/// keyed on `(session_id, blob_key)`.
+///
+/// Return: `Ok(())` on success, or the underlying `SQLite` error.
+pub fn store_blob(
+    conn: &Connection,
+    session_id: &str,
+    blob_key: &str,
+    data: &[u8],
+    mime_type: Option<&str>,
+) -> Result<()> {
+    let created_at = chrono::Utc::now().timestamp_millis();
+    conn.execute(
+        "INSERT OR REPLACE INTO blobs (session_id, blob_key, data, mime_type, created_at) VALUES (?1, ?2, ?3, ?4, ?5)",
+        params![session_id, blob_key, data, mime_type, created_at],
+    )?;
+    Ok(())
+}
+
+/// Fetch a blob's bytes for a session by key.
+///
+/// Return: `Ok(Some(data))` if found, `Ok(None)` if no matching row
+/// exists, `Err` for any other `SQLite` failure.
+pub fn retrieve_blob(
+    conn: &Connection,
+    session_id: &str,
+    blob_key: &str,
+) -> Result<Option<Vec<u8>>> {
+    let result = conn.query_row(
+        "SELECT data FROM blobs WHERE session_id = ?1 AND blob_key = ?2",
+        params![session_id, blob_key],
+        |row| row.get(0),
+    );
+    match result {
+        Ok(data) => Ok(Some(data)),
+        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// List all blob keys stored for a session, oldest first.
+///
+/// Return: `Ok(Vec<String>)` of keys ordered by `created_at`, or the
+/// underlying `SQLite` error.
+pub fn list_blob_keys(conn: &Connection, session_id: &str) -> Result<Vec<String>> {
+    let mut stmt =
+        conn.prepare("SELECT blob_key FROM blobs WHERE session_id = ?1 ORDER BY created_at ASC")?;
+    let rows = stmt.query_map(params![session_id], |row| row.get::<_, String>(0))?;
+    let mut keys = Vec::new();
+    for row in rows {
+        keys.push(row?);
+    }
+    Ok(keys)
+}