refactor(api): enforce protocol-neutral service boundaries

- refactor: move HTTP status and DTO concerns out of model and service
  layers into API and handler code.
- feat: add admin service boundary and route auth through services
  instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
  redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
  architecture and roadmap notes.

internal/service/admin.go

@@ -0,0 +1,51 @@
+package service
+
+import (
+	"context"
+	"errors"
+
+	"github.com/dhao2001/mygo/internal/model"
+	"github.com/dhao2001/mygo/internal/repository"
+)
+
+// AdminService handles administrator user-management operations.
+type AdminService struct {
+	userRepo repository.UserRepository
+}
+
+// NewAdminService creates an AdminService.
+func NewAdminService(userRepo repository.UserRepository) *AdminService {
+	return &AdminService{userRepo: userRepo}
+}
+
+// GetUser returns a user by ID, including deleted users.
+func (s *AdminService) GetUser(ctx context.Context, id string) (*model.User, error) {
+	user, err := s.userRepo.FindByIDIncludeDeleted(ctx, id)
+	if err != nil {
+		if errors.Is(err, model.ErrNotFound) {
+			return nil, model.NewNotFoundError("user not found", model.ErrNotFound)
+		}
+		return nil, model.NewInternalError("find admin user", err)
+	}
+	return user, nil
+}
+
+// ListUsers returns all users, including deleted users, with pagination.
+func (s *AdminService) ListUsers(ctx context.Context, offset, limit int) ([]model.User, int64, error) {
+	users, total, err := s.userRepo.ListIncludeDeleted(ctx, offset, limit)
+	if err != nil {
+		return nil, 0, model.NewInternalError("list admin users", err)
+	}
+	return users, total, nil
+}
+
+// DeleteUser soft-deletes a user.
+func (s *AdminService) DeleteUser(ctx context.Context, id string) error {
+	if _, err := s.GetUser(ctx, id); err != nil {
+		return err
+	}
+	if err := s.userRepo.Delete(ctx, id); err != nil {
+		return model.NewInternalError("delete admin user", err)
+	}
+	return nil
+}