refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-iam/src/domain/service.rs

@@ -0,0 +1,36 @@
+#![allow(
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss,
+    clippy::cast_precision_loss,
+    clippy::cast_possible_wrap
+)]
+//! Service trait definitions — use-case interfaces for session management
+//! and OAuth flows.
+use crate::domain::oauth::{OAuthConfig, OAuthToken};
+use crate::domain::session::Session;
+
+/// Session management use-case boundary.
+pub trait SessionService {
+    /// Create a new session with a generated UUID and the given title.
+    fn create_session(&self, title: &str) -> anyhow::Result<Session>;
+
+    /// List all available sessions.
+    fn list_all(&self) -> anyhow::Result<Vec<Session>>;
+
+    /// Archive a session by id (sets `archived = true`).
+    fn archive_session(&self, id: &str) -> anyhow::Result<()>;
+}
+
+/// OAuth flow use-case boundary.
+pub trait OAuthService {
+    /// Start an OAuth authorization-code + PKCE flow.
+    /// Returns the provider's authorization URL to visit.
+    fn start_flow(&self, config: &OAuthConfig) -> anyhow::Result<String>;
+
+    /// Complete the OAuth flow by exchanging an authorization code for a
+    /// token.
+    fn complete_flow(&self, config: &OAuthConfig, code: &str) -> anyhow::Result<OAuthToken>;
+
+    /// Retrieve the currently stored OAuth token (if any).
+    fn get_token(&self) -> anyhow::Result<Option<OAuthToken>>;
+}