refactor(http): deepen route registration into per-feature modules

[allisson]

Summary

Deepens the seam between feature modules and the HTTP server. internal/http/server.go was the single most-churned file in the repo (13 edits in the last 40 commits) because every feature change had to touch it, plus RouterDeps (a 13-field inventory duplicated across di.go and server.go) and four near-identical register*Routes funcs.

After this change, each feature owns its route registration next to its handlers, and server.go imports no feature package.

What changed

• New seam in internal/http (imports only gin + metrics): RouteRegistrar interface + RouteMiddlewares{Auth, RateLimit} bundle. SetupRouter is now feature-agnostic — it builds the global middleware chain and loops over a []RouteRegistrar.
• Four feature Modules (auth, secrets, transit, tokenization) — each captures its handlers + authorizer + business metrics and registers its own routes. Verbatim relocation of the existing gin stanzas; no behavior change. The auth module owns the /token irregular layout (no-auth + IP-based rate limit).
• di.go builds all middleware (auth, rate-limit, token-rate-limit, authorizer), assembles the registrars, and calls the new SetupRouter. CLI access to the container is untouched.
• Deleted: RouterDeps + the four register*Routes funcs (~320 lines).
• Import direction reversed: http → features becomes features → internal/http (no cycle).
• CONTEXT.md: recorded Route Module, RouteRegistrar, RouteMiddlewares.

A follow-up chore commit bumps Go 1.26.3 → 1.26.5 and updates dependencies.

Test plan

• Route-manifest golden test (server_routes_test.go) — asserts the full set of 35 method + path pairs is byte-identical before and after the relocation.
• make test (race) — 1250 pass.
• make test-integration (serial, DB up) — green, including the auth + authz + business-metrics end-to-end flows.
• make lint — golangci clean.
• Verified server.go imports no feature-http package.

🤖 Generated with Claude Code