refactor(auth): eliminate barrel index.ts — direct imports per module

[2witstudios]

Problem

apps/web/src/lib/auth/index.ts is a 607-line barrel with 35 export statements that re-exports session auth, CSRF, device auth, rate limiting, permissions, and DB access all in one file.

Every API route that does:

import { authenticateRequestWithOptions } from '@/lib/auth'

...transitively loads @pagespace/db, session service, device auth, rate limiting, encryption utilities — regardless of what it actually needs. This makes import graphs impossible to reason about, hurts startup time, and is the root cause of a build failure hit during the pnpm→bun migration (#1392): a 'use client' component imported a pure URL utility from auth-helpers.ts, which re-exports from index.ts, which imports pg — blowing up the client bundle when pg changed its internal require pattern.

We fixed the immediate symptom (extracted url-utils.ts, added server-only guard), but the barrel is still there.

Additionally:

• auth-helpers.ts still re-exports isSafeReturnUrl, isSafeNextPath, SIGNIN_NEXT_ALLOWED_PREFIXES from url-utils.ts for backward compat — those callers should import from url-utils directly
• index.ts re-exports isSafeReturnUrl from auth-helpers — a pure string utility that doesn't belong in the auth barrel at all

Proposed Fix

Split index.ts into focused direct-import modules:

Module	Exports
session.ts	authenticateSessionRequest, authenticateRequestWithOptions, authenticateWithEnforcedContext
device.ts	createDeviceToken, createWebDeviceToken, revokeSessionsForLogin
mcp.ts	checkMCPDriveScope, checkMCPCreateScope, filterDrivesByMCPScope
url-utils.ts	isSafeReturnUrl, isSafeNextPath, SIGNIN_NEXT_ALLOWED_PREFIXES (already done)

Update the ~30 API route files to import from the specific module rather than the barrel. Delete index.ts or reduce it to a thin re-export shim if external consumers need the @/lib/auth path during transition.

Scope

• apps/web/src/lib/auth/index.ts — split
• apps/web/src/lib/auth/auth-helpers.ts — remove re-export of url-utils symbols
• ~30 apps/web/src/app/api/**/route.ts files — update imports
• apps/web/src/app/admin/layout.tsx — update import

References

• PR feat(tooling): migrate from pnpm to bun workspace #1392 (pnpm→bun migration) where barrel poisoning was discovered
• apps/web/src/lib/auth/url-utils.ts — the extracted client-safe module