refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-middleware/src/cors.rs

@@ -0,0 +1,48 @@
+#![allow(
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss,
+    clippy::cast_precision_loss,
+    clippy::cast_possible_wrap
+)]
+//! CORS layer factory for the daemon HTTP (IPC) server.
+//!
+//! Since the daemon only listens on `127.0.0.1`, the CORS policy is
+//! intentionally permissive.  These settings are still required because
+//! Axum rejects cross-origin requests unless a CORS layer is present.
+
+use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};
+
+/// Return a permissive [`CorsLayer`] for local daemon IPC.
+///
+/// - **Origin**: any (`*`)
+/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
+/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
+///   `X-Request-Id`, `User-Agent`
+pub fn default_cors_layer() -> CorsLayer {
+    CorsLayer::new()
+        .allow_origin(AllowOrigin::any())
+        .allow_methods([
+            "GET".parse().unwrap(),
+            "POST".parse().unwrap(),
+            "PUT".parse().unwrap(),
+            "DELETE".parse().unwrap(),
+            "PATCH".parse().unwrap(),
+            "OPTIONS".parse().unwrap(),
+        ])
+        .allow_headers(AllowHeaders::any())
+        .expose_headers([
+            "Content-Type".parse().unwrap(),
+            "X-Session-Id".parse().unwrap(),
+            "X-Request-Id".parse().unwrap(),
+        ])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_default_cors_layer_constructs() {
+        let _layer = default_cors_layer();
+    }
+}