refactor(api): extract account/auth/setup/admin; façade is now spread-only (R7.5 S2)

Move the last four inline domains out of lib/api.ts into per-domain slices,
each owning its types + method slice. The barrel now holds ZERO endpoint logic
and zero types of its own — it only re-exports core's HTTP machinery, re-exports
each domain's types, and spreads the 15 slices into the single `api` object.

A new endpoint therefore has nowhere to land but a domain module. The `api`
shape and all call sites are unchanged (every req/beacon call byte-identical
to dev; no method dropped, no key collision).

frontend/src/lib/api/auth.ts

@@ -0,0 +1,67 @@
+// The sign-in funnel: public auth config, email+password register/login/reset, email verification,
+// session management, access requests, and the hidden demo login. Errors on the interactive paths
+// are surfaced inline (quiet) rather than via the global modal. Only touches core's req.
+import { req } from "./core";
+
+export const authApi = {
+  // Public: which sign-in options this instance offers (e.g. hide Google when not configured).
+  authConfig: (): Promise<{
+    google_enabled: boolean;
+    allow_registration: boolean;
+    operator_contact: string | null;
+  }> => req("/auth/config"),
+
+  // --- email + password (errors handled inline via quiet) ---
+  register: (email: string, password: string): Promise<{ status: string }> =>
+    req(
+      "/auth/register",
+      { method: "POST", body: JSON.stringify({ email, password }) },
+      { quiet: true },
+    ),
+  passwordLogin: (email: string, password: string): Promise<{ ok: boolean }> =>
+    req(
+      "/auth/password-login",
+      { method: "POST", body: JSON.stringify({ email, password }) },
+      { quiet: true },
+    ),
+  requestPasswordReset: (email: string): Promise<{ status: string }> =>
+    req(
+      "/auth/password-reset/request",
+      { method: "POST", body: JSON.stringify({ email }) },
+      { quiet: true },
+    ),
+  confirmPasswordReset: (token: string, password: string): Promise<{ ok: boolean }> =>
+    req(
+      "/auth/password-reset/confirm",
+      { method: "POST", body: JSON.stringify({ token, password }) },
+      { quiet: true },
+    ),
+  // Confirm an email-verification token the SPA read from the URL fragment (SB3).
+  verifyEmail: (token: string): Promise<{ ok: boolean }> =>
+    req("/auth/verify", { method: "POST", body: JSON.stringify({ token }) }, { quiet: true }),
+  // Re-issue a verification link (the first one expired, or was lost). Uniform response — never
+  // reveals whether the email has a pending account.
+  resendVerification: (email: string): Promise<{ status: string }> =>
+    req(
+      "/auth/verify/resend",
+      { method: "POST", body: JSON.stringify({ email }) },
+      { quiet: true },
+    ),
+  // SA4: sign every OTHER session for this account out (keeps the current one).
+  logoutOthers: (): Promise<{ ok: boolean }> => req("/auth/logout-others", { method: "POST" }),
+  // Set or change the signed-in account's password (errors shown inline via quiet).
+  setPassword: (password: string, currentPassword?: string): Promise<{ ok: boolean }> =>
+    req(
+      "/auth/set-password",
+      { method: "POST", body: JSON.stringify({ password, current_password: currentPassword }) },
+      { quiet: true },
+    ),
+
+  // --- onboarding: access requests + demo entry ---
+  requestAccess: (email: string): Promise<{ status: string }> =>
+    req("/auth/request-access", { method: "POST", body: JSON.stringify({ email }) }),
+  // Hidden demo entry: a whitelisted email logs into the shared demo account, no Google
+  // sign-in. Returns whether a session was established.
+  demoLogin: (email: string): Promise<{ authenticated: boolean }> =>
+    req("/auth/demo", { method: "POST", body: JSON.stringify({ email }) }),
+};