refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-iam/src/infrastructure/http/dto.rs

@@ -0,0 +1,63 @@
+#![allow(
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss,
+    clippy::cast_precision_loss,
+    clippy::cast_possible_wrap
+)]
+//! IAM-specific HTTP / IPC DTOs (Data Transfer Objects).
+use serde::{Deserialize, Serialize};
+
+use crate::domain::oauth::{OAuthConfig, OAuthToken};
+use crate::domain::session::Session;
+
+// ---------------------------------------------------------------------------
+// Session DTOs
+// ---------------------------------------------------------------------------
+
+/// Request body for creating a new session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CreateSessionRequest {
+    pub title: String,
+}
+
+/// Response containing one session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SessionResponse {
+    pub session: Session,
+}
+
+/// Response containing a list of sessions.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SessionListResponse {
+    pub sessions: Vec<Session>,
+    pub total: usize,
+}
+
+// ---------------------------------------------------------------------------
+// OAuth DTOs
+// ---------------------------------------------------------------------------
+
+/// Request body for starting an OAuth flow.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthStartRequest {
+    pub config: OAuthConfig,
+}
+
+/// Response containing the authorization URL for an OAuth flow.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthStartResponse {
+    pub auth_url: String,
+}
+
+/// Request body for completing an OAuth flow with an authorization code.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthCompleteRequest {
+    pub config: OAuthConfig,
+    pub code: String,
+}
+
+/// Response containing the acquired OAuth token.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthTokenResponse {
+    pub token: OAuthToken,
+}