Refactor: split serve/server.py (3220 lines) into focused modules

serve/server.py is now 69 lines — app factory, middleware, and router
registration only.

New modules:
  deps.py    (168 lines) — module-level globals + auth dependency functions
  models.py   (85 lines) — all Pydantic request/response models
  tasks.py   (136 lines) — background workers and job tracker
  routers/               — one file per domain (10 routers, ~2750 lines total)
    auth.py, me.py, admin.py, activities.py, uploads.py,
    segments.py, strava.py, garmin.py, ideas.py, feed.py

cli.py updated to set globals on deps instead of server.

88 new regression tests in tests/serve/ cover auth guards and key
behaviours for every router; 294 total passing after the split.

tests/serve/test_strava_router.py

@@ -0,0 +1,23 @@
+"""Pre-split regression tests for /api/strava/* routes."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+
+class TestStravaRoutes:
+    def test_status_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/strava/status").status_code == 401
+
+    def test_disconnect_unauthenticated_returns_401(self, client: TestClient):
+        assert client.post("/api/strava/disconnect").status_code == 401
+
+    def test_auth_url_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/strava/auth-url").status_code == 401
+
+    def test_sync_unauthenticated_returns_401(self, client: TestClient):
+        assert client.post("/api/strava/sync").status_code == 401
+
+    def test_status_authenticated_returns_connected_field(self, user_client: TestClient):
+        r = user_client.get("/api/strava/status")
+        assert r.status_code == 200
+        assert "connected" in r.json()