refactor(auth): factory-style use cases + controllers + real Payload impls

- Use cases (sign-in, sign-up, sign-out) → factory functions with I*UseCase aliases
- Controllers → factory functions with I*Controller aliases
- DI symbols + module updated with .toDynamicValue() bindings for factories
- New: real UsersRepository (Payload-backed, SanitizedConfig, contract-tested)
- New: real AuthenticationService (node:crypto hashing/UUIDs; createSession/
  validateSession/invalidateSession deferred — see refactor log §7)
- bindProductionAuth swaps both mocks for real impls (was a no-op before)
- Tests refactored to construct mocks and inject directly (no container rebinding)
- Feature test constructs full chain via direct factory injection

Refactor log: §2, §4.1, §4.2, §5.1, §5.2, §6.1, §7
Spec: §6.1, §7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/interface-adapters/controllers/sign-in.controller.ts

@@ -2,20 +2,22 @@ import { z } from "zod";
 
 import { InputParseError } from "../../entities/errors/common";
 import type { Cookie } from "../../entities/models/cookie";
-import { signInUseCase } from "../../application/use-cases/sign-in.use-case";
+import type { ISignInUseCase } from "../../application/use-cases/sign-in.use-case";
 
 const inputSchema = z.object({
   username: z.string().min(3).max(31),
   password: z.string().min(6).max(255),
 });
 
-export async function signInController(
-  input: Partial<z.infer<typeof inputSchema>>,
-): Promise<Cookie> {
-  const parsed = inputSchema.safeParse(input);
-  if (!parsed.success) {
-    throw new InputParseError("Invalid sign-in input", { cause: parsed.error });
-  }
-  const { cookie } = await signInUseCase(parsed.data);
-  return cookie;
-}
+export type ISignInController = ReturnType<typeof signInController>;
+
+export const signInController =
+  (signInUseCase: ISignInUseCase) =>
+  async (input: Partial<z.infer<typeof inputSchema>>): Promise<Cookie> => {
+    const parsed = inputSchema.safeParse(input);
+    if (!parsed.success) {
+      throw new InputParseError("Invalid sign-in input", { cause: parsed.error });
+    }
+    const { cookie } = await signInUseCase(parsed.data);
+    return cookie;
+  };