refactor(auth): split application capabilities

[capybaracplusplus]

Summary

• replace the monolithic AuthService and endpoint-specific password classes with four capability services: IdentityService, AuthenticationService, SessionService, and PasswordService
• keep userver integration in one AuthApplicationComponent composition root and expose ordinary C++ services to the HTTP handlers
• introduce a shared PasswordPolicy and PasswordValidator for sign-up, password change, and password reset
• split the oversized service test fixture into capability-focused suites with shared test fakes
• update the architecture documentation to describe the resulting boundaries

Why

The previous AuthService mixed identity lifecycle, credential authentication, token rotation, session management, and user lookup in one class. The first extraction also left password behavior split between a single-endpoint use case and a separate reset service. The new boundaries follow stable authentication capabilities instead of HTTP endpoints, reduce constructor and test-fixture scope, and avoid turning every operation into its own service.

Behavior

There are no public API, OpenAPI, database-schema, migration, or runtime-configuration changes. Strong reads, enumeration-safe reset requests, PostgreSQL-backed rate limits, refresh-token rotation and reuse detection, hashed reset tokens, transactional outbox delivery, and session revocation semantics remain unchanged. The runtime component name stays auth-service, so existing YAML configuration remains compatible.

Validation

• Release production profile configured and built successfully
• 73 unit tests passed
• full Release CTest, including the userver functional testsuite, passed
• all changed C++ files pass clang-format --dry-run --Werror
• git diff --check passed
• Debug/ASan/UBSan compiled all changed translation units locally; the ARM devcontainer killed the final static sanitizer link due to its memory limit, so the GitHub Debug job is the authoritative sanitizer gate