refactor(services): extract auth module and isolate server rate limiter

[OneStepAt4time]

Summary

Implements issue #1614 by extracting auth concerns into a dedicated service module and isolating route rate-limiter logic from server.ts.

What changed

• Added src/services/auth/ package:
  • AuthManager.ts (migrated auth implementation from src/auth.ts)
  • RateLimiter.ts (extracted IP + auth-failure rate limiting from server.ts)

  • ypes.ts (auth domain types)
    

  • index.ts (public exports)
• Updated src/server.ts:
  • imports auth from services/auth
  • replaces in-file rate-limit helpers with RateLimiter instance
  • keeps existing behavior and limits unchanged
• Updated src/ws-terminal.ts type import to new auth service entrypoint
• Kept src/auth.ts as compatibility re-export to avoid breaking legacy imports/tests
• Added src/tests/auth-rate-limiter.test.ts for extracted limiter behavior
• Updated docs/architecture.md to document new auth service structure

Validation

pm run build ✅

px tsc --noEmit ✅

pm test ✅

• Additional targeted suites for auth/server paths passed:
  • auth core tests
  • auth verify endpoint
  • batch rate-limit route
  • ws-terminal tests

Closes #1614