feat(auth): migrate anonymous consent on signUp when cc_consent cookie present

Adds ConsentFactoryProtocol / ConsentGrantMeta / ConsentProtocol to
core-shared/di/bind-protocols so feature binders can wire per-user
consent without a hard dep on the optional @repo/core-consent package.
BindContext gains an optional consentFactory? field following the same
pattern as bus?, auditLog?, etc.

signUpUseCase gains a 4th optional dep (consentFactory). When present
and the input includes a cookieHeader containing cc_consent=<categories>,
the use case calls consent.grant for each category with
method:"signup-migration" and returns a clearCookie payload (Max-Age:0)
so the anonymous cookie is cleared on the HTTP response.

Tests use RecordingConsent from @repo/core-testing to assert migration
call shape and cookie-clear; no-cookie and no-factory branches are also
covered. All coverage bands hold at 100% for use-cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/di/bind-dev-seed.ts

@@ -38,7 +38,15 @@ import type { IAuthenticationService } from "../application/services/authenticat
  * populated repo and rebinds the symbol.
  */
 export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
-  const { tracer, logger, bus, queue, realtime, realtimeRegistry } = ctx;
+  const {
+    tracer,
+    logger,
+    bus,
+    queue,
+    realtime,
+    realtimeRegistry,
+    consentFactory,
+  } = ctx;
 
   // Bind shared instrumentation into feature container
   if (authContainer.isBound(INSTRUMENTATION_SYMBOLS.TRACER)) {
@@ -88,7 +96,7 @@ export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignUpUseCase,
     factory: signUpUseCase,
-    deps: [repo, authService, bus],
+    deps: [repo, authService, bus, consentFactory],
     feature: "auth",
     layer: "use-case",
     name: "signUp",