refactor(core): export the remaining handlers and verifiers from the root

[Bccorb]

PR 5 of #72, the last item in the epic.

Problem

Six modules were reachable only through a subpath import: the admin, session, internal-metrics, and system-config handlers, plus verifySignedAuthResponse and verifyRefreshCookie. Everything else came from the package root, so which import form an adapter needed depended on which handler it wanted.

Change

27 names are now exported from @seamless-auth/core as well:

createUserHandler, deleteUserHandler, getAuthEventSummaryHandler,
getAuthEventTimeseriesHandler, getAuthEventsHandler, getAvailableRolesHandler,
getCredentialCountHandler, getDashboardMetricsHandler, getGroupedEventSummaryHandler,
getLoginStatsHandler, getSecurityAnomaliesHandler, getSystemConfigAdminHandler,
getUserAnomaliesHandler, getUserDetailHandler, getUsersHandler, listAllSessionsHandler,
listSessionsHandler, listUserSessionsHandler, recoverUserForDeviceReplacementHandler,
revokeAllSessionsHandler, revokeAllUserSessionsHandler, revokeSessionHandler,
revokeUserSessionHandler, updateSystemConfigHandler, updateUserHandler,
verifyRefreshCookie, verifySignedAuthResponse

Purely additive

The root export list was captured before and after and diffed: 27 added, nothing removed or renamed. I checked for name collisions across every module the root re-exports before adding these; there are none, which is why export * is safe here.

The ./handlers/* subpaths keep working, and a new test asserts that a subpath import and a root import resolve to the same function, not two module instances:

expect(namespace[exported]).toBe(root[exported]);

That matters because adopters already import from the subpaths, and identity mismatch would be a subtle way to break them.

README

The public API overview had drifted: it still listed 11 exports and never mentioned applyResult, proxyRequest, deliverAuthMessage, or the contract values added in PRs 1 to 4 of this epic. Rewritten and grouped by what an adapter author is actually looking for: sessions and cookies, building an adapter, auth flow handlers, admin and operations handlers, message delivery, auth API contract, utilities.

publicExports.test.js mirrors that section by design, so it grew with it. It now covers 48 functions and the contract constants, and fails at module link time if any documented name stops being exported.

Checks

pnpm build clean. pnpm test passes: 49 suites, 332 tests (up 45, almost all from the expanded export coverage).

Epic status

This closes the last of the five sub-items in #72. Still tracked there, outside the epic, are the two items that save a new adapter no lines: extracting the copy-pasted core session helpers with a typed UpstreamSessionResponse, and an injectable logger. Also open is #125, the empty upstream body on passthrough routes.