refactor(auth): move the request guards out of api-handler into lib/auth/guards

api-handler.ts held two modules: the route wrapper and thirteen guards. The
guards now live in lib/auth/guards/, one module per family (the caller,
the acting-account carrier, the record modes, the cookie-only helpers, the
fresh-factor and recent-proof gates, the Bearer elevation, MFA management).
api-handler.ts keeps the wrapper and re-exports every guard, so it stays the
one public entry and no route changes its import.

The bodies move verbatim; only the version prefixes of moved comments are
dropped. The structural guards that read the auth layer now find the module
that declares a guard by name (helpers/auth-guards.ts) instead of a fixed
path, and a new guard holds the entry: nothing outside the folder but
api-handler.ts imports a guard module.

src/app/api/sync/state/__tests__/route.test.ts

@@ -2,7 +2,7 @@
  * `GET /api/sync/state` is a read.
  *
  * It used to bump `User.lastSyncedAt` on every call, which is the exact
- * side-effecting GET the MCP-audience note in `api-handler.ts` warns against,
+ * side-effecting GET the MCP-audience note in `lib/auth/guards/context.ts` warns against,
  * and it advanced the checkpoint past a window the client had not drained.
  * The checkpoint is now owned by the ingest boundaries; this route reports it.
  */