refactor(auth-ui): restructure to layered cloud-portal architecture

Squash of the 23-commit refactor/auth-ui-restructure branch. Behavior-preserving throughout (URL paths and auth flows unchanged); full gate green (react-router typegen, tsc, 657 vitest tests, build, eslint) and verified live against Zitadel.

Pass 1 — flat app/ reorganized into the cloud-portal layered model: routes/ (domain-nested), resources/<domain>/, modules/auth/ (providers + session), components/<name>/, with tests co-located in __tests__/.

Pass 2 — per-domain route logic extracted into resources/<domain>/<domain>.service.ts; routes thinned to parse->service->render/redirect; route tests rewritten as service tests; client/server module boundary enforced.

Post-restructure refinements:
- Service export verbs aligned to one convention (verify=read-only check, submit/record=write, resolve=route/dispatch); submitPassword->verifyLoginPassword and 7 sibling renames.
- Schemas centralized per-domain in server-free resources/<domain>/<domain>.schema.ts; resources/schemas/ keeps only shared primitives (check-your-email, request-id); client/server boundary hardened (schema files carry no @/server imports).
- routes.ts grouped by domain with nested layout.tsx per sub-folder (2+ routes); login layout hoists the side-effect-free URL render-context consumed via useRouteLoaderData('login'); other layouts Outlet-only.
- Prettier import-sort applied across the refactored files.

Author: yahyafakhroji

app/components/auth-card.tsx app/components/auth-card/auth-card.tsxapp/components/auth-card.tsx renamed to app/components/auth-card/auth-card.tsx

@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { WebAuthnButton } from './webauthn-button';
+import { WebAuthnButton } from '@/components/webauthn-button/webauthn-button';
 import { setupI18n } from '@lingui/core';
 import { I18nProvider } from '@lingui/react';
 import { render, screen, fireEvent } from '@testing-library/react';
@@ -21,8 +21,8 @@ vi.mock('react-router', () => ({
 // Mock isWebAuthnSupported to return true so the null-publicKey guard is reached
 // rather than falling through to the CYPRESS_CREDENTIAL shortcut
 // (in happy-dom window.PublicKeyCredential is undefined, which would skip the error branches).
-vi.mock('@/flows/webauthn', async (importOriginal) => {
-  const mod = await importOriginal<typeof import('@/flows/webauthn')>();
+vi.mock('@/resources/webauthn/webauthn', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('@/resources/webauthn/webauthn')>();
   return { ...mod, isWebAuthnSupported: () => true };
 });
 

app/components/auth-form.tsx app/components/auth-form/auth-form.tsxapp/components/auth-form.tsx renamed to app/components/auth-form/auth-form.tsx

@@ -1,10 +1,10 @@
 import {
   createAttestation,
-  getAssertion,
+  marshalAssertion,
   isWebAuthnSupported,
   WebAuthnUnsupportedError,
   type WebAuthnChallengeInput,
-} from '@/flows/webauthn';
+} from '@/resources/webauthn/webauthn';
 import { Button } from '@datum-cloud/datum-ui/button';
 import { Trans } from '@lingui/react/macro';
 import { useEffect, useState } from 'react';
@@ -105,7 +105,7 @@ export function WebAuthnButton({
           credential = await createAttestation(publicKey as WebAuthnChallengeInput);
         } else {
           // Verification ceremony (default): navigator.credentials.get
-          credential = await getAssertion(publicKey as WebAuthnChallengeInput);
+          credential = await marshalAssertion(publicKey as WebAuthnChallengeInput);
         }
       }
 

app/components/webauthn-button.test.tsx …utton/__tests__/webauthn-button.test.tsxapp/components/webauthn-button.test.tsx renamed to app/components/webauthn-button/__tests__/webauthn-button.test.tsx app/components/webauthn-button.test.tsx renamed to app/components/webauthn-button/__tests__/webauthn-button.test.tsx

@@ -14,8 +14,8 @@
 //
 // These declarations are compile-only (no runtime values are created). void-ing them
 // suppresses the unused-variable diagnostic.
-import type { AuthProvider } from './auth-provider';
-import type { IdpIntentResult, IdpLink } from './types';
+import type { AuthProvider } from '@/modules/auth/auth-provider';
+import type { IdpIntentResult, IdpLink } from '@/modules/auth/types';
 // Vitest requires at least one describe/it block to register the file as a test file.
 import { describe, it } from 'vitest';
 

app/components/webauthn-button.tsx …ents/webauthn-button/webauthn-button.tsxapp/components/webauthn-button.tsx renamed to app/components/webauthn-button/webauthn-button.tsx app/components/webauthn-button.tsx renamed to app/components/webauthn-button/webauthn-button.tsx

@@ -1,5 +1,5 @@
-import { idpTypeToSlug, slugToProvider } from './idp-slug';
-import type { IdProvider } from './types';
+import { idpTypeToSlug, slugToProvider } from '@/modules/auth/idp-slug';
+import type { IdProvider } from '@/modules/auth/types';
 import { describe, it, expect } from 'vitest';
 
 const google: IdProvider = { id: 'idp-g', name: 'Google', type: 'GOOGLE' };

app/providers/auth-provider.types.test.ts …th/__tests__/auth-provider.types.test.tsapp/providers/auth-provider.types.test.ts renamed to app/modules/auth/__tests__/auth-provider.types.test.ts app/providers/auth-provider.types.test.ts renamed to app/modules/auth/__tests__/auth-provider.types.test.ts

@@ -1,5 +1,5 @@
-import { FakeAuthProvider } from './fake/fake-provider';
-import { getAuthProvider } from './select.server';
+import { FakeAuthProvider } from '@/modules/auth/providers/fake/fake-provider';
+import { getAuthProvider } from '@/modules/auth/select.server';
 import { describe, it, expect } from 'vitest';
 
 describe('getAuthProvider', () => {