refactor(api): enforce protocol-neutral service boundaries

- refactor: move HTTP status and DTO concerns out of model and service
  layers into API and handler code.
- feat: add admin service boundary and route auth through services
  instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
  redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
  architecture and roadmap notes.

internal/model/file_test.go

@@ -6,18 +6,20 @@ import (
 	"time"
 )
 
-func TestFile_StatusExcludedFromJSON(t *testing.T) {
+func TestFileJSONOmitsInternalFields(t *testing.T) {
 	f := &File{
-		ID:        "1",
-		UserID:    "u1",
-		ParentID:  nil,
-		Name:      "test.txt",
-		Size:      100,
-		MimeType:  "text/plain",
-		Status:    StatusActive,
-		IsDir:     false,
-		CreatedAt: time.Now(),
-		UpdatedAt: time.Now(),
+		ID:          "1",
+		UserID:      "u1",
+		ParentID:    nil,
+		Name:        "test.txt",
+		Size:        100,
+		MimeType:    "text/plain",
+		StoragePath: "users/u1/files/1",
+		Hash:        "abc123",
+		Status:      StatusActive,
+		IsDir:       false,
+		CreatedAt:   time.Now(),
+		UpdatedAt:   time.Now(),
 	}
 
 	data, err := json.Marshal(f)
@@ -30,13 +32,11 @@ func TestFile_StatusExcludedFromJSON(t *testing.T) {
 		t.Fatalf("json.Unmarshal: %v", err)
 	}
 
-	if _, ok := result["status"]; ok {
-		t.Errorf("Status field should be excluded from JSON (json:\"-\"), but it appeared in output")
-	}
-
-	if _, ok := result["hash"]; ok {
-		t.Errorf("Hash field should be excluded from JSON (json:\"-\"), but it appeared in output")
-	}
+	assertJSONKeysAbsent(t, result,
+		"StoragePath", "storage_path",
+		"Hash", "hash",
+		"Status", "status",
+	)
 }
 
 func TestStatusConstants(t *testing.T) {