Refactor: split serve/server.py (3220 lines) into focused modules

serve/server.py is now 69 lines — app factory, middleware, and router
registration only.

New modules:
  deps.py    (168 lines) — module-level globals + auth dependency functions
  models.py   (85 lines) — all Pydantic request/response models
  tasks.py   (136 lines) — background workers and job tracker
  routers/               — one file per domain (10 routers, ~2750 lines total)
    auth.py, me.py, admin.py, activities.py, uploads.py,
    segments.py, strava.py, garmin.py, ideas.py, feed.py

cli.py updated to set globals on deps instead of server.

88 new regression tests in tests/serve/ cover auth guards and key
behaviours for every router; 294 total passing after the split.

bincio/serve/cli.py

@@ -37,6 +37,7 @@ def serve(data_dir: str, site_dir: Optional[str], host: str, port: int,
     """
     import uvicorn
     import bincio.serve.server as srv
+    from bincio.serve import deps
     from bincio.serve.db import open_db, set_setting, get_setting
 
     dd = Path(data_dir).expanduser().resolve()
@@ -50,21 +51,21 @@ def serve(data_dir: str, site_dir: Optional[str], host: str, port: int,
         set_setting(db, "max_users", str(max_users))
         db.close()
 
-    srv.data_dir = dd
+    deps.data_dir = dd
     if site_dir:
-        srv.site_dir = Path(site_dir).expanduser().resolve()
+        deps.site_dir = Path(site_dir).expanduser().resolve()
     if strava_client_id:
-        srv.strava_client_id = strava_client_id
+        deps.strava_client_id = strava_client_id
     if strava_client_secret:
-        srv.strava_client_secret = strava_client_secret
+        deps.strava_client_secret = strava_client_secret
     if public_url:
-        srv.public_url = public_url
+        deps.public_url = public_url
     if webroot and site_dir:
-        srv.webroot = Path(webroot).expanduser().resolve()
+        deps.webroot = Path(webroot).expanduser().resolve()
     if dem_url:
-        srv.dem_url = dem_url
+        deps.dem_url = dem_url
     if sync_secret:
-        srv.sync_secret = sync_secret
+        deps.sync_secret = sync_secret
 
     db = open_db(dd)
     current_limit = get_setting(db, "max_users")
@@ -72,16 +73,16 @@ def serve(data_dir: str, site_dir: Optional[str], host: str, port: int,
 
     console.print(f"[bold]bincio serve[/bold]")
     console.print(f"  Data:  [cyan]{dd}[/cyan]")
-    if srv.site_dir:
-        console.print(f"  Site:  [cyan]{srv.site_dir}[/cyan]")
-    if srv.webroot:
-        console.print(f"  Web:   [cyan]{srv.webroot}[/cyan] (auto-rebuild on upload)")
+    if deps.site_dir:
+        console.print(f"  Site:  [cyan]{deps.site_dir}[/cyan]")
+    if deps.webroot:
+        console.print(f"  Web:   [cyan]{deps.webroot}[/cyan] (auto-rebuild on upload)")
     console.print(f"  URL:   [cyan]http://{host}:{port}[/cyan]")
     if current_limit and int(current_limit) > 0:
         console.print(f"  Users: [yellow]max {current_limit}[/yellow]")
     else:
         console.print(f"  Users: [dim]unlimited[/dim]")
-    console.print(f"  DEM:   [cyan]{srv.dem_url}[/cyan]")
+    console.print(f"  DEM:   [cyan]{deps.dem_url}[/cyan]")
     console.print()
 
     log_config = uvicorn.config.LOGGING_CONFIG.copy()