Document token.go vs service.go architectural split

[menor]

Context

The auth package has two files with related but distinct responsibilities:

• service.go - Business logic orchestration (Login, Logout, Status)
• token.go - API client integration via oauth2.TokenSource

The split exists because oauth2.TokenSource interface requires storing context in a struct (documented anti-pattern exception).

Task

Add documentation (code comments or CLAUDE.md section) explaining:

1. Why these responsibilities are split
2. When to use Service vs TokenSource
3. The oauth2.TokenSource interface constraint

Priority

Low

Effort

Low