refactor(api): enforce protocol-neutral service boundaries

- refactor: move HTTP status and DTO concerns out of model and service
  layers into API and handler code.
- feat: add admin service boundary and route auth through services
  instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
  redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
  architecture and roadmap notes.

internal/model/user.go

@@ -6,14 +6,14 @@ import (
 
 // User represents a registered account.
 type User struct {
-	ID           string    `gorm:"primaryKey;type:varchar(36)" json:"id"`
-	Username     string    `gorm:"uniqueIndex;type:varchar(64);not null" json:"username"`
-	Email        string    `gorm:"uniqueIndex;type:varchar(255);not null" json:"email"`
-	PasswordHash string    `gorm:"type:varchar(255);not null" json:"-"`
-	IsAdmin      bool      `gorm:"default:false" json:"is_admin"`
-	Status       string    `gorm:"type:varchar(32);not null;default:active;index" json:"-"`
-	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt    time.Time `json:"updated_at"`
+	ID           string `gorm:"primaryKey;type:varchar(36)"`
+	Username     string `gorm:"uniqueIndex;type:varchar(64);not null"`
+	Email        string `gorm:"uniqueIndex;type:varchar(255);not null"`
+	PasswordHash string `gorm:"type:varchar(255);not null" json:"-"`
+	IsAdmin      bool   `gorm:"default:false"`
+	Status       string `gorm:"type:varchar(32);not null;default:active;index"`
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
 }
 
 // User status constants.