feat(auth): migrate anonymous consent on signUp when cc_consent cookie present

Adds ConsentFactoryProtocol / ConsentGrantMeta / ConsentProtocol to
core-shared/di/bind-protocols so feature binders can wire per-user
consent without a hard dep on the optional @repo/core-consent package.
BindContext gains an optional consentFactory? field following the same
pattern as bus?, auditLog?, etc.

signUpUseCase gains a 4th optional dep (consentFactory). When present
and the input includes a cookieHeader containing cc_consent=<categories>,
the use case calls consent.grant for each category with
method:"signup-migration" and returns a clearCookie payload (Max-Age:0)
so the anonymous cookie is cleared on the HTTP response.

Tests use RecordingConsent from @repo/core-testing to assert migration
call shape and cookie-clear; no-cookie and no-factory branches are also
covered. All coverage bands hold at 100% for use-cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/di/bind-dev-seed.ts

@@ -38,7 +38,15 @@ import type { IAuthenticationService } from "../application/services/authenticat
  * populated repo and rebinds the symbol.
  */
 export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
-  const { tracer, logger, bus, queue, realtime, realtimeRegistry } = ctx;
+  const {
+    tracer,
+    logger,
+    bus,
+    queue,
+    realtime,
+    realtimeRegistry,
+    consentFactory,
+  } = ctx;
 
   // Bind shared instrumentation into feature container
   if (authContainer.isBound(INSTRUMENTATION_SYMBOLS.TRACER)) {
@@ -88,7 +96,7 @@ export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignUpUseCase,
     factory: signUpUseCase,
-    deps: [repo, authService, bus],
+    deps: [repo, authService, bus, consentFactory],
     feature: "auth",
     layer: "use-case",
     name: "signUp",

packages/auth/src/di/bind-production.ts

@@ -30,8 +30,16 @@ export function bindProductionAuth(ctx: BindProductionContext): void {
   if (bound) return;
   bound = true;
 
-  const { config, tracer, logger, bus, queue, realtime, realtimeRegistry } =
-    ctx;
+  const {
+    config,
+    tracer,
+    logger,
+    bus,
+    queue,
+    realtime,
+    realtimeRegistry,
+    consentFactory,
+  } = ctx;
 
   // Bind shared instrumentation into feature container
   if (authContainer.isBound(INSTRUMENTATION_SYMBOLS.TRACER)) {
@@ -80,7 +88,7 @@ export function bindProductionAuth(ctx: BindProductionContext): void {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignUpUseCase,
     factory: signUpUseCase,
-    deps: [repo, authService, bus],
+    deps: [repo, authService, bus, consentFactory],
     feature: "auth",
     layer: "use-case",
     name: "signUp",

packages/auth/src/di/module.ts

@@ -39,7 +39,9 @@ export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
   bind<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase).toDynamicValue((ctx) =>
     signInUseCase(
       ctx.container.get<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository),
-      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+      ctx.container.get<IAuthenticationService>(
+        AUTH_SYMBOLS.IAuthenticationService,
+      ),
     ),
   );
 
@@ -49,32 +51,40 @@ export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
     // bus instance when @repo/core-events is scaffolded.
     signUpUseCase(
       ctx.container.get<IUsersRepository>(AUTH_SYMBOLS.IUsersRepository),
-      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+      ctx.container.get<IAuthenticationService>(
+        AUTH_SYMBOLS.IAuthenticationService,
+      ),
+      undefined,
       undefined,
     ),
   );
 
   bind<ISignOutUseCase>(AUTH_SYMBOLS.ISignOutUseCase).toDynamicValue((ctx) =>
     signOutUseCase(
-      ctx.container.get<IAuthenticationService>(AUTH_SYMBOLS.IAuthenticationService),
+      ctx.container.get<IAuthenticationService>(
+        AUTH_SYMBOLS.IAuthenticationService,
+      ),
     ),
   );
 
-  bind<ISignInController>(AUTH_SYMBOLS.ISignInController).toDynamicValue((ctx) =>
-    signInController(
-      ctx.container.get<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase),
-    ),
+  bind<ISignInController>(AUTH_SYMBOLS.ISignInController).toDynamicValue(
+    (ctx) =>
+      signInController(
+        ctx.container.get<ISignInUseCase>(AUTH_SYMBOLS.ISignInUseCase),
+      ),
   );
 
-  bind<ISignUpController>(AUTH_SYMBOLS.ISignUpController).toDynamicValue((ctx) =>
-    signUpController(
-      ctx.container.get<ISignUpUseCase>(AUTH_SYMBOLS.ISignUpUseCase),
-    ),
+  bind<ISignUpController>(AUTH_SYMBOLS.ISignUpController).toDynamicValue(
+    (ctx) =>
+      signUpController(
+        ctx.container.get<ISignUpUseCase>(AUTH_SYMBOLS.ISignUpUseCase),
+      ),
   );
 
-  bind<ISignOutController>(AUTH_SYMBOLS.ISignOutController).toDynamicValue((ctx) =>
-    signOutController(
-      ctx.container.get<ISignOutUseCase>(AUTH_SYMBOLS.ISignOutUseCase),
-    ),
+  bind<ISignOutController>(AUTH_SYMBOLS.ISignOutController).toDynamicValue(
+    (ctx) =>
+      signOutController(
+        ctx.container.get<ISignOutUseCase>(AUTH_SYMBOLS.ISignOutUseCase),
+      ),
   );
 });