feat(repository): refactor query/mutation ports with capability-safe

interfaces

- refactor: split UserRepository into AuthUserRepository and
  AdminUserRepository capabilities
- refactor: split SessionRepository into AuthSessionRepository and
  repository-owned CLI/admin methods
- refactor: replace generic Repository Update/Delete with
  operation-specific params and ownership predicates
- refactor: replace CredentialRepository generic CRUD with
  passkey-specific methods
- refactor: replace FileRepository generic Create/Update/Delete with
  UploadedFileParams, DirectoryParams, and owned soft-delete
- refactor: remove repository fields from WebApp struct; repositories
  are now composition-time wiring only
- feat: add domain error kinds ErrParentNotFound, ErrParentNotDir,
  ErrDirectoryNotEmpty, ErrInvalidMove
- feat: add CredentialTypeAppPasskey constant
- feat: add testutil.SetUserAdmin for test fixture setup that bypasses
  production service ports
- test: add architecture test banning GORM Save in repository package
- test: add capability interface contract tests ensuring each service
  receives the minimal interface
- test: add blockingStorage helper for concurrent promotion tests
- test: add preserved DSN parameter test for sqliteImmediateDSN
- docs: update architecture decisions with repository write rules and
  capability separation
- docs: update roadmap to clarify atomic single-use refresh sessions
- docs: add -race test target to development docs

docs/server/development.md

@@ -17,6 +17,7 @@ go build -o mygo .
 ```bash
 go test ./...
 go test -v -run TestName ./internal/...
+go test -race ./internal/repository ./internal/service ./internal/server
 ```
 
 ## Lint & Format
@@ -52,6 +53,12 @@ go mod tidy     # after adding/removing imports
 
 Server config is loaded via viper from `config.yaml` (defaults in `internal/config/load.go`).
 
+For SQLite, the repository preserves configured DSN parameters and adds
+`_txlock=immediate`. Write transactions therefore reserve the database before
+performing hierarchy or refresh-session reads, matching the locking assumptions
+used by the repository commands. Keep this behavior when supplying a SQLite URI
+such as `file:mygo.db?cache=shared`.
+
 ```yaml
 server:
     host: 0.0.0.0