feat(auth): migrate anonymous consent on signUp when cc_consent cookie present

Adds ConsentFactoryProtocol / ConsentGrantMeta / ConsentProtocol to
core-shared/di/bind-protocols so feature binders can wire per-user
consent without a hard dep on the optional @repo/core-consent package.
BindContext gains an optional consentFactory? field following the same
pattern as bus?, auditLog?, etc.

signUpUseCase gains a 4th optional dep (consentFactory). When present
and the input includes a cookieHeader containing cc_consent=<categories>,
the use case calls consent.grant for each category with
method:"signup-migration" and returns a clearCookie payload (Max-Age:0)
so the anonymous cookie is cleared on the HTTP response.

Tests use RecordingConsent from @repo/core-testing to assert migration
call shape and cookie-clear; no-cookie and no-factory branches are also
covered. All coverage bands hold at 100% for use-cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/src/di/bind-context.ts

@@ -8,6 +8,7 @@ import type {
   MetricsProtocol,
   AuditLogProtocol,
   AnalyticsProtocol,
+  ConsentFactoryProtocol,
 } from "./bind-protocols";
 
 /** Always-present fields. Feature binders rely on these unconditionally. */
@@ -43,6 +44,7 @@ export type BindContext<
   metrics?: Metrics;
   auditLog?: Audit;
   analytics?: Analytics;
+  consentFactory?: ConsentFactoryProtocol;
 };
 
 /** Production binders also receive the resolved Payload config. */

packages/core-shared/src/di/bind-protocols.ts

@@ -80,3 +80,23 @@ export type AnalyticsProtocol = {
     attributes?: Record<string, string | number | boolean>,
   ): void;
 };
+
+/**
+ * Minimal consent protocol surface. `IConsent` (in optional `@repo/core-consent`)
+ * extends this — typechecks fail if narrowed below. Feature binders that
+ * receive `ctx.consentFactory` see only this protocol type.
+ */
+export type ConsentGrantMeta = {
+  method?: string;
+  bannerVersion?: string;
+  policyVersion?: string;
+};
+
+export type ConsentProtocol = {
+  grant(category: string, meta?: ConsentGrantMeta): Promise<void>;
+};
+
+/** Factory that creates a per-user consent instance. Mirrors ConsentFactory in `@repo/core-consent`. */
+export type ConsentFactoryProtocol = (
+  userId: string,
+) => Promise<ConsentProtocol>;