refactor: group root packages by role (access, authz, http, proof)

[jmgilman]

Summary

Reorganize the 17 flat root packages into four conceptual buckets so the layout telegraphs each package's role:

access/{jwt,middleware}        # was accessjwt, accessjwtauth
authz/{role,casbin}            # was roleauth, casbin
http/{auth,facts,compose}      # was httpauth, httpfacts, compose
proof/{oidc,passkey,apikey}    # was oidc, passkey, apikey (passkey/session under proof/passkey/)
exchange/                      # unchanged
onboarding/                    # unchanged
provisioning/                  # unchanged
management/                    # unchanged
store/                         # unchanged
testkit/                       # unchanged

There are no external consumers; this is the cheapest moment to do this. The change is purely mechanical: no logic, no schema, no port, no exported-symbol changes beyond their package qualifiers.

What changes

• Five packages have their package name changed alongside the path move:
  • accessjwt -> access/jwt (package accessjwt -> jwt)
  • accessjwtauth -> access/middleware (package accessjwtauth -> middleware)
  • roleauth -> authz/role (package roleauth -> role)
  • httpauth -> http/auth (package httpauth -> auth)
  • httpfacts -> http/facts (package httpfacts -> facts)
• The remaining six (compose, oidc, passkey, passkey/session, apikey, casbin) keep their package names; only the import path changes.
• Internal error-prefix strings updated for renamed packages ("accessjwt: ..." -> "jwt: ..." etc.). No consumer matches these via string comparison.
• One prep commit (e3879f1) introduces a jwxjwt alias for github.com/lestrrat-go/jwx/v3/jwt inside accessjwt/ to free the jwt package name without colliding with the third-party import. Same trick was needed in testkit/internal/httpui/server_test.go.
• One sundry test fix: http/facts/facts_test.go's local merged-result variable renamed facts -> got to avoid shadowing the newly-renamed package.
• Root doc.go now lists the four subgroups so newcomers can scan the layout at a glance. Docusaurus pages and per-package sibling-mentioning doc.go files updated.

Verification

• moon run root:check --summary minimal — green (format, lint, build, unit tests).
• moon run root:integration — green (Testcontainers postgres exercises the storage suite against the relocated proof/* packages).
• moon run docs:typecheck && moon run docs:build — green.
• Exported-surface diff for all 11 renamed packages: identical (no symbols accidentally renamed). Compared go list -f exports against master.
• git grep for old import paths and symbol prefixes in *.go and docs/docs/**/*.md: clean.

Out of scope

• internal/authtest, internal/storetest — internal helpers, left at root.
• store/memory, store/postgres — already grouped, untouched.
• testkit/ — internal validation app, left at root.
• management/, exchange/, onboarding/, provisioning/ — already meaningful top-level names; no parent buys clarity.
• CHANGELOG.md, PLAN.md — historical artifacts, left alone.

Test plan

• go build ./... clean.
• moon run root:check --summary minimal clean.
• moon run root:integration clean.
• moon run docs:build clean.
• Spot-check go doc github.com/meigma/authkit/access/jwt (and friends) shows the same symbol surface as the old packages.
• Concurrent worktree on feat/httpapi-auth-flow will need a one-time rebase after this merges.

🤖 Generated with Claude Code