refactor(api): enforce protocol-neutral service boundaries

- refactor: move HTTP status and DTO concerns out of model and service
  layers into API and handler code.
- feat: add admin service boundary and route auth through services
  instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
  redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
  architecture and roadmap notes.

internal/server/routes_protected.go

@@ -9,12 +9,11 @@ import (
 )
 
 func setupProtectedRoutes(rg *gin.RouterGroup, webApp *app.WebApp) {
-	jwtSecret := []byte(webApp.Config.JWT.Secret)
 	accountHandler := handler.NewAccountHandler(webApp.AuthService)
 	fileHandler := handler.NewFileHandler(webApp.FileService)
-	adminHandler := handler.NewAdminHandler(webApp.UserRepo)
+	adminHandler := handler.NewAdminHandler(webApp.AdminService)
 
-	rg.Use(middleware.AuthRequired(jwtSecret))
+	rg.Use(middleware.AuthRequired(webApp.AuthService))
 
 	account := rg.Group("/account")
 	{
@@ -39,7 +38,7 @@ func setupProtectedRoutes(rg *gin.RouterGroup, webApp *app.WebApp) {
 	}
 
 	admin := rg.Group("/admin")
-	admin.Use(middleware.AdminRequired(webApp.UserRepo))
+	admin.Use(middleware.AdminRequired())
 	{
 		admin.GET("/users", adminHandler.ListUsers)
 		admin.GET("/users/:id", adminHandler.GetUser)