refactor: migrate monolithic crate to Cargo Workspace with Clean Architecture

Transform the single binary crate into a 9-crate workspace monorepo:

- Root Cargo.toml as [workspace] manager with resolver = "2"
- zesdex-entities: Domain entity types (session, settings, store, message, etc.)
- zesdex-utils: Pure utility functions (error, logger, pagination, slug, clipboard)
- zesdex-dto: Data Transfer Objects for LLM provider API communication
- zesdex-ipc: Unix-socket IPC layer (client/server/framing/protocol)
- zesdex-iam: Identity & Access Management (Clean Architecture: domain/application/infrastructure)
- zesdex-cms: Content Management (Clean Architecture: domain/application/infrastructure)
- zesdex-middleware: HTTP middleware (Auth, CORS, Rate Limiting)
- zesdex-libs: Composition root (AppContext, DB init, JWT, Argon2)
- zesdex-backend: Main binary entry point + seed/migrate binaries
- DevOps: Dockerfile, docker-compose, Nix (flake/shell/default), CI/CD updates
- Remove dead root src/ and src-misc/ directories

All crate re-exports maintain backward compatibility with original
crate::model::*, crate::dto::*, crate::ipc::* module paths.
Feature crates enforce strict layer separation: domain -> application
-> infrastructure with generic trait-based dependency injection.

crates/zesdex-iam/src/infrastructure/http/dto.rs

@@ -0,0 +1,63 @@
+#![allow(
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss,
+    clippy::cast_precision_loss,
+    clippy::cast_possible_wrap
+)]
+//! IAM-specific HTTP / IPC DTOs (Data Transfer Objects).
+use serde::{Deserialize, Serialize};
+
+use crate::domain::oauth::{OAuthConfig, OAuthToken};
+use crate::domain::session::Session;
+
+// ---------------------------------------------------------------------------
+// Session DTOs
+// ---------------------------------------------------------------------------
+
+/// Request body for creating a new session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CreateSessionRequest {
+    pub title: String,
+}
+
+/// Response containing one session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SessionResponse {
+    pub session: Session,
+}
+
+/// Response containing a list of sessions.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SessionListResponse {
+    pub sessions: Vec<Session>,
+    pub total: usize,
+}
+
+// ---------------------------------------------------------------------------
+// OAuth DTOs
+// ---------------------------------------------------------------------------
+
+/// Request body for starting an OAuth flow.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthStartRequest {
+    pub config: OAuthConfig,
+}
+
+/// Response containing the authorization URL for an OAuth flow.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthStartResponse {
+    pub auth_url: String,
+}
+
+/// Request body for completing an OAuth flow with an authorization code.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthCompleteRequest {
+    pub config: OAuthConfig,
+    pub code: String,
+}
+
+/// Response containing the acquired OAuth token.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OAuthTokenResponse {
+    pub token: OAuthToken,
+}

crates/zesdex-iam/src/infrastructure/http/handlers.rs

@@ -0,0 +1,73 @@
+#![allow(
+    clippy::cast_possible_truncation,
+    clippy::cast_sign_loss,
+    clippy::cast_precision_loss,
+    clippy::cast_possible_wrap
+)]
+//! IPC / HTTP handler functions.
+//!
+//! Each handler is a plain function that takes a service reference and a
+//! request DTO, delegates to the service, and returns a response DTO.
+//! Handlers are generic over the service trait so they remain independent
+//! of concrete implementations.
+
+use crate::domain::service::{OAuthService, SessionService};
+use crate::infrastructure::http::dto::{
+    CreateSessionRequest, OAuthCompleteRequest, OAuthStartRequest, OAuthStartResponse,
+    OAuthTokenResponse, SessionListResponse, SessionResponse,
+};
+
+/// Handle a create-session request.
+pub fn handle_create_session<S: SessionService>(
+    service: &S,
+    req: CreateSessionRequest,
+) -> anyhow::Result<SessionResponse> {
+    let session = service.create_session(&req.title)?;
+    Ok(SessionResponse { session })
+}
+
+/// Handle a list-sessions request.
+pub fn handle_list_sessions<S: SessionService>(
+    service: &S,
+) -> anyhow::Result<SessionListResponse> {
+    let sessions = service.list_all()?;
+    let total = sessions.len();
+    Ok(SessionListResponse { sessions, total })
+}
+
+/// Handle an archive-session request.
+pub fn handle_archive_session<S: SessionService>(
+    service: &S,
+    id: &str,
+) -> anyhow::Result<()> {
+    service.archive_session(id)?;
+    Ok(())
+}
+
+/// Handle a start-OAuth-flow request.
+pub fn handle_start_oauth<O: OAuthService>(
+    service: &O,
+    req: OAuthStartRequest,
+) -> anyhow::Result<OAuthStartResponse> {
+    let auth_url = service.start_flow(&req.config)?;
+    Ok(OAuthStartResponse { auth_url })
+}
+
+/// Handle a complete-OAuth-flow request.
+pub fn handle_complete_oauth<O: OAuthService>(
+    service: &O,
+    req: OAuthCompleteRequest,
+) -> anyhow::Result<OAuthTokenResponse> {
+    let token = service.complete_flow(&req.config, &req.code)?;
+    Ok(OAuthTokenResponse { token })
+}
+
+/// Handle a get-token request.
+pub fn handle_get_token<O: OAuthService>(
+    service: &O,
+) -> anyhow::Result<OAuthTokenResponse> {
+    let token = service
+        .get_token()?
+        .ok_or_else(|| anyhow::anyhow!("no OAuth token stored"))?;
+    Ok(OAuthTokenResponse { token })
+}

crates/zesdex-iam/src/infrastructure/http/mod.rs

@@ -0,0 +1,2 @@
+pub mod dto;
+pub mod handlers;