Refactor repo into coherent feature slices

[iam-brain]

Summary

• consolidate size-driven micro-modules into coherent config, storage, OAuth, UI, and request-transform owners
• preserve top-level entrypoints while simplifying internal boundaries, tests, docs, and ESM guard scripts
• restore the dist import fail-fast guard and keep the config barrel export surface stable after the refactor

Testing

• direct Node check: node scripts/check-esm-import-specifiers.mjs --dist from a temp dir now fails fast when dist/ is missing
• git diff --check
• full npm run verify previously passed for this refactor before moving into this worktree
• note: this worktree is missing local vitest/tsc binaries, so I could not rerun the automated suites here

Audit

• subagent audit flagged the missing dist/ fail-fast guard and dropped config barrel exports
• both follow-ups were patched before opening this PR

[iam-brain]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e0f943f5fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add ratchet baselines for newly introduced source files

This refactor introduces new TypeScript paths (for example lib/ui/tty.ts) without corresponding entries in scripts/coverage-ratchet.baseline.json, but scripts/check-coverage-ratchet.mjs fails changed files that have coverage and no baseline entry. With this commit range, the ratchet already reports lib/ui/tty.ts: missing coverage baseline entry, so npm run verify will fail once coverage is generated; please add baseline records for all newly added/renamed .ts files in this diff.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate dist root is a directory in --dist mode

The --dist guard now checks only existsSync(dist) and does not verify that dist is a directory, so a plain file named dist makes the script exit successfully without scanning any built JS files. This regresses the old fail-fast behavior and can produce false-positive passes for check:dist-esm-imports when build output is missing or malformed.

Useful? React with 👍 / 👎.