refactor(auth): factory-style use cases + controllers + real Payload impls

- Use cases (sign-in, sign-up, sign-out) → factory functions with I*UseCase aliases
- Controllers → factory functions with I*Controller aliases
- DI symbols + module updated with .toDynamicValue() bindings for factories
- New: real UsersRepository (Payload-backed, SanitizedConfig, contract-tested)
- New: real AuthenticationService (node:crypto hashing/UUIDs; createSession/
  validateSession/invalidateSession deferred — see refactor log §7)
- bindProductionAuth swaps both mocks for real impls (was a no-op before)
- Tests refactored to construct mocks and inject directly (no container rebinding)
- Feature test constructs full chain via direct factory injection

Refactor log: §2, §4.1, §4.2, §5.1, §5.2, §6.1, §7
Spec: §6.1, §7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/application/use-cases/sign-in.use-case.ts

@@ -1,34 +1,32 @@
 import { AuthenticationError } from "../../entities/errors/auth";
 import type { Cookie } from "../../entities/models/cookie";
 import type { Session } from "../../entities/models/session";
-import { authContainer } from "../../di/container";
-import { AUTH_SYMBOLS } from "../../di/symbols";
 import type { IUsersRepository } from "../repositories/users.repository.interface";
 import type { IAuthenticationService } from "../services/authentication.service.interface";
 
-export async function signInUseCase(input: {
-  username: string;
-  password: string;
-}): Promise<{ session: Session; cookie: Cookie }> {
-  const usersRepository = authContainer.get<IUsersRepository>(
-    AUTH_SYMBOLS.IUsersRepository,
-  );
-  const authService = authContainer.get<IAuthenticationService>(
-    AUTH_SYMBOLS.IAuthenticationService,
-  );
+export type ISignInUseCase = ReturnType<typeof signInUseCase>;
 
-  const existingUser = await usersRepository.getUserByUsername(input.username);
-  if (!existingUser) {
-    throw new AuthenticationError("User does not exist");
-  }
+export const signInUseCase =
+  (
+    usersRepository: IUsersRepository,
+    authenticationService: IAuthenticationService,
+  ) =>
+  async (input: {
+    username: string;
+    password: string;
+  }): Promise<{ session: Session; cookie: Cookie }> => {
+    const existingUser = await usersRepository.getUserByUsername(input.username);
+    if (!existingUser) {
+      throw new AuthenticationError("User does not exist");
+    }
 
-  const validPassword = await authService.verifyPassword(
-    existingUser.passwordHash,
-    input.password,
-  );
-  if (!validPassword) {
-    throw new AuthenticationError("Incorrect username or password");
-  }
+    const validPassword = await authenticationService.verifyPassword(
+      existingUser.passwordHash,
+      input.password,
+    );
+    if (!validPassword) {
+      throw new AuthenticationError("Incorrect username or password");
+    }
 
-  return await authService.createSession(existingUser);
-}
+    return await authenticationService.createSession(existingUser);
+  };