Refactor: split serve/server.py (3220 lines) into focused modules

serve/server.py is now 69 lines — app factory, middleware, and router
registration only.

New modules:
  deps.py    (168 lines) — module-level globals + auth dependency functions
  models.py   (85 lines) — all Pydantic request/response models
  tasks.py   (136 lines) — background workers and job tracker
  routers/               — one file per domain (10 routers, ~2750 lines total)
    auth.py, me.py, admin.py, activities.py, uploads.py,
    segments.py, strava.py, garmin.py, ideas.py, feed.py

cli.py updated to set globals on deps instead of server.

88 new regression tests in tests/serve/ cover auth guards and key
behaviours for every router; 294 total passing after the split.

tests/serve/test_me_router.py

@@ -0,0 +1,77 @@
+"""Pre-split regression tests for /api/me/* routes."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+
+class TestMeEndpoint:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/me").status_code == 401
+
+    def test_authenticated_returns_user(self, user_client: TestClient):
+        r = user_client.get("/api/me")
+        assert r.status_code == 200
+        data = r.json()
+        assert data["handle"] == "alice"
+        assert "is_admin" in data
+
+
+class TestMeStorage:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/me/storage").status_code == 401
+
+    def test_authenticated_returns_storage(self, user_client: TestClient):
+        r = user_client.get("/api/me/storage")
+        assert r.status_code == 200
+        assert "total_mb" in r.json()
+
+
+class TestMePrefs:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/me/prefs").status_code == 401
+        assert client.put("/api/me/prefs", json={}).status_code == 401
+
+    def test_get_prefs_empty(self, user_client: TestClient):
+        r = user_client.get("/api/me/prefs")
+        assert r.status_code == 200
+        assert isinstance(r.json(), dict)
+
+    def test_set_and_get_prefs(self, user_client: TestClient):
+        user_client.put("/api/me/prefs", json={"theme": "dark"})
+        r = user_client.get("/api/me/prefs")
+        assert r.json().get("theme") == "dark"
+
+
+class TestMePassword:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.put("/api/me/password", json={}).status_code == 401
+
+    def test_wrong_current_password_returns_401(self, user_client: TestClient):
+        r = user_client.put("/api/me/password",
+                            json={"current_password": "wrong", "new_password": "newpass123"})
+        assert r.status_code == 401
+
+    def test_short_new_password_returns_400(self, user_client: TestClient):
+        r = user_client.put("/api/me/password",
+                            json={"current_password": "alicepass1", "new_password": "short"})
+        assert r.status_code == 400
+
+
+class TestMeDisplayName:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.put("/api/me/display-name", json={}).status_code == 401
+
+    def test_update_display_name(self, user_client: TestClient):
+        r = user_client.put("/api/me/display-name", json={"display_name": "Alice Smith"})
+        assert r.status_code == 200
+        assert r.json()["display_name"] == "Alice Smith"
+
+
+class TestMeStravaCredentials:
+    def test_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/me/strava-credentials").status_code == 401
+
+    def test_authenticated_returns_status(self, user_client: TestClient):
+        r = user_client.get("/api/me/strava-credentials")
+        assert r.status_code == 200
+        assert "has_user_creds" in r.json()