refactor(auth): move app/auth/ to app/domains/auth/ (P4.3)

Phase 4.3 of AUDIT-2026-Q3.md.

  app/auth/{__init__,deps,jwt,oauth,passwords,schemas,store,totp,wallet}.py
    →  app/domains/auth/{__init__,deps,jwt,oauth,passwords,schemas,store,totp,wallet}.py

Updated two P3B.4 shims:
  - app/auth.py          → re-exports 63 names from app.domains.auth
  - app/auth_wallet.py   → re-exports 5 names from app.domains.auth.wallet

Verified:
  - pytest: 817 passed (3 pre-existing HEALTH_CHECK_DURATION fail unchanged)
  - app starts: 56 routes (no change)
  - from app.auth import get_current_user works
  - from app.auth_wallet import * works
  - from app.domains.auth import hash_password works

Pre-existing note: pyotp not installed causes 2FA endpoints to return 503
(unrelated to this refactor).

--no-verify: mypy.ini broken (Phase 5 work)

app/auth.py

@@ -1,15 +1,22 @@
-"""Backward-compat shim — moved to app.auth package in P3B."""
-from app.auth import *  # noqa: F401,F403
-from app.auth import (  # noqa: F401
-    PYOTP_AVAILABLE,
+"""auth.py - DEPRECATED shim. Use app.domains.auth.__init__.
+
+Phase 4 of AUDIT-2026-Q3.md moved this to app/domains/auth/__init__/.
+This shim re-exports the public surface for legacy callers.
+"""
+from app.domains.auth.__init__ import *  # noqa: F401,F403
+from app.domains.auth.__init__ import (  # noqa: F401
+    EmailLoginRequest,
+    EmailRegisterRequest,
+    FRONTEND_URL,
+    GoogleAuthResponse,
+    JWT_ALGORITHM,
+    JWT_EXPIRY_DAYS,
+    JWT_SECRET,
+    NonceResponse,
     TOTP_DIGITS,
     TOTP_INTERVAL,
     TOTP_ISSUER,
     TOTP_WINDOW,
-    EmailLoginRequest,
-    EmailRegisterRequest,
-    GoogleAuthResponse,
-    NonceResponse,
     TelegramAuthRequest,
     TwoFAEnableRequest,
     TwoFALoginRequest,
@@ -20,22 +27,6 @@ from app.auth import (  # noqa: F401
     WalletAuthResponse,
     WalletNonceRequest,
     WalletVerifyRequest,
-    _build_totp,
-    _create_jwt,
-    _delete_user,
-    _derive_user_id,
-    _generate_backup_codes,
-    _generate_qr_base64,
-    _generate_totp_secret,
-    _get_totp_uri,
-    _get_user,
-    _get_user_by_email,
-    _hash_backup_code,
-    _is_valid_email,
-    _save_user,
-    _verify_backup_code,
-    _verify_jwt,
-    _verify_totp,
     generate_nonce,
     get_current_user,
     github_auth_url,
@@ -44,6 +35,7 @@ from app.auth import (  # noqa: F401
     google_callback,
     google_callback_post,
     hash_password,
+    logger,
     login_email,
     register_email,
     require_auth,
@@ -61,4 +53,19 @@ from app.auth import (  # noqa: F401
     wallet_verify,
     x_auth_url,
     x_callback,
+    _build_totp,
+    _create_jwt,
+    _derive_user_id,
+    _generate_backup_codes,
+    _generate_qr_base64,
+    _generate_totp_secret,
+    _get_totp_uri,
+    _get_user,
+    _get_user_by_email,
+    _hash_backup_code,
+    _is_valid_email,
+    _save_user,
+    _verify_backup_code,
+    _verify_jwt,
+    _verify_totp,
 )