chore: move auth backend to proper DI

Fold the 1497-line services/authService.ts into the DI-native nest/auth
domain (Wave-5 chain opener, unblocked by the atlas fold):

- Pure crypto half (backup-code hash/match/generate, stripUserForClient,
  key masking, the import-time DUMMY_PASSWORD_HASH timing equaliser and
  avatarDir mkdir — documented parity exceptions) moves verbatim to the
  plain module nest/auth/auth.helpers.ts.
- DB half folds into AuthService over DatabaseService + injected
  PermissionsService (ex permissions.bridge) + AtlasService (ex
  atlas.bridge, deleted on schedule). mfaSetupPending and the per-email
  reset throttle stay module-scoped so the bridge and container instances
  share them; avatarDir and require('../../../package.json') re-anchor one
  directory deeper — with the two injection swaps, the only non-verbatim
  lines. Controller-facing method surface unchanged.
- New 8-export auth.bridge.ts for out-of-container consumers: mcp/index.ts
  token verification, the journey/notifications/transports registrars'
  isDemoUser, and the still-legacy adminService/oidcService/passkeyService.
- 15 domain *.mcp.ts demo guards now inject AuthService (their modules
  import AuthModule); atlas.mcp.ts alone stays on the bridge because
  AuthService injects AtlasService and the reverse module edge would close
  an AuthModule<->AtlasModule cycle (places.mcp precedent). OidcService and
  PasskeyEnabledGuard inject AuthService too.
- Tests move with case IDs preserved: authService.test.ts ->
  auth.helpers.test.ts, authServiceDb.test.ts -> auth.service.test.ts
  (+ AUTH-BR-001..007 bridge delegation, + AUTH-DB-050..088 pinning the
  previously untested getAppConfig/login/MFA/reset/admin-settings branches
  now under the src/nest coverage gate). auth.e2e converts DI-native (real
  bcrypt, real audit rows); oidc.e2e swaps its dead path mock for an
  instance spy; websocket/integration suites repoint to bridge/helpers.

Quirks preserved byte-for-byte (0-coord drop in getTravelStats,
un-transactioned registerUser/verifyMfaLogin multi-writes, unguarded
revokeUserSessions in deleteMcpToken, current! assertions in
updateApiKeys) — fixes land separately.

server/tests/helpers/mcp-test-controllers.ts

@@ -5,6 +5,7 @@ import { AssignmentsMcp } from '../../src/nest/assignments/assignments.mcp';
 import { AssignmentsService } from '../../src/nest/assignments/assignments.service';
 import { AtlasMcp } from '../../src/nest/atlas/atlas.mcp';
 import { AtlasService } from '../../src/nest/atlas/atlas.service';
+import { AuthService } from '../../src/nest/auth/auth.service';
 import { BudgetMcp } from '../../src/nest/budget/budget.mcp';
 import { BudgetService } from '../../src/nest/budget/budget.service';
 import { ExchangeRatesService } from '../../src/nest/budget/exchange-rates.service';
@@ -54,6 +55,7 @@ import { RealtimeService } from '../../src/nest/realtime/realtime.service';
 export function createMcpTestRegistry(): McpRegistry {
   const dbService = new DatabaseService(db);
   const permissionsService = new PermissionsService(dbService);
+  const authService = new AuthService(dbService, permissionsService, new AtlasService(dbService));
   const realtimeService = new RealtimeService();
   const daysService = new DaysService(dbService, permissionsService, realtimeService);
   const exchangeRatesService = new ExchangeRatesService();
@@ -80,23 +82,23 @@ export function createMcpTestRegistry(): McpRegistry {
   );
   return createTestRegistry(
     [
-      new TagsMcp(new TagsService(dbService)),
+      new TagsMcp(new TagsService(dbService), authService),
       new CategoriesMcp(new CategoriesService(dbService)),
-      new TodoMcp(todoService),
-      new PackingMcp(packingService),
-      new BudgetMcp(budgetService, exchangeRatesService, dbService),
-      new ReservationsMcp(reservationsService, daysService, budgetService),
-      new DayNotesMcp(new DayNotesService(dbService, permissionsService, realtimeService)),
-      new DaysMcp(daysService, dbService, placesService),
-      new AssignmentsMcp(new AssignmentsService(dbService, permissionsService, realtimeService), daysService),
-      new CollabMcp(collabService),
-      new VacayMcp(new VacayService(dbService, realtimeService)),
-      new TripsMcp(tripsService, todoService, collabService),
-      new ShareMcp(new ShareService(dbService, new SettingsService(dbService), permissionsService)),
+      new TodoMcp(todoService, authService),
+      new PackingMcp(packingService, authService),
+      new BudgetMcp(budgetService, exchangeRatesService, dbService, authService),
+      new ReservationsMcp(reservationsService, daysService, budgetService, authService),
+      new DayNotesMcp(new DayNotesService(dbService, permissionsService, realtimeService), authService),
+      new DaysMcp(daysService, dbService, placesService, authService),
+      new AssignmentsMcp(new AssignmentsService(dbService, permissionsService, realtimeService), daysService, authService),
+      new CollabMcp(collabService, authService),
+      new VacayMcp(new VacayService(dbService, realtimeService), authService),
+      new TripsMcp(tripsService, todoService, collabService, authService),
+      new ShareMcp(new ShareService(dbService, new SettingsService(dbService), permissionsService), authService),
       new MapsMcp(mapsService),
-      new PlacesMcp(placesService, mapsService, dbService),
-      new CollectionsMcp(new CollectionsService(dbService, permissionsService, realtimeService), dbService),
-      new TransitMcp(new TransitService(), daysService, reservationsService, dbService),
+      new PlacesMcp(placesService, mapsService, dbService, authService),
+      new CollectionsMcp(new CollectionsService(dbService, permissionsService, realtimeService), dbService, authService),
+      new TransitMcp(new TransitService(), daysService, reservationsService, dbService, authService),
       new AtlasMcp(new AtlasService(dbService)),
     ],
     { accessPolicy: trekMcpAccessPolicy, validateAccess: trekMcpValidateAccess },