refactor(auth): clarify module responsibilities

[rd-code-23]

What changed

• group Google OIDC routes and user provisioning under auth/google
• group PostgreSQL session middleware under auth/session
• add descriptive .routes, .service, and .middleware filename suffixes
• keep each test colocated with the implementation it verifies
• update imports and concise project architecture guidance

Why

The previous auth filenames identified the feature but not each module’s role. This structure keeps vertical feature organization while making routes, services, middleware, and tests immediately recognizable without adding unnecessary controller or repository layers.

Developer impact

New or modified feature files should use descriptive role suffixes where helpful and focused capability subfolders as features grow. Empty architectural layers are not required.

Validation

• scoped Prettier check
• pnpm --filter @goforlift/api lint
• pnpm --filter @goforlift/api typecheck
• pnpm --filter @goforlift/api test — 34 tests passed
• pnpm --filter @goforlift/api build