refactor: restructure domain crate by bounded context

crates/domain/src/identity/ports.rs

@@ -0,0 +1,50 @@
+use async_trait::async_trait;
+use crate::common::errors::DomainError;
+use crate::common::value_objects::{Email, PasswordHash, SystemId};
+use super::entities::{Group, Role, User};
+
+// --- UserRepository ---
+
+#[async_trait]
+pub trait UserRepository: Send + Sync {
+    async fn find_by_id(&self, id: &SystemId) -> Result<Option<User>, DomainError>;
+    async fn find_by_email(&self, email: &Email) -> Result<Option<User>, DomainError>;
+    async fn find_by_username(&self, username: &str) -> Result<Option<User>, DomainError>;
+    async fn save(&self, user: &User) -> Result<(), DomainError>;
+    async fn delete(&self, id: &SystemId) -> Result<(), DomainError>;
+}
+
+// --- RoleRepository ---
+
+#[async_trait]
+pub trait RoleRepository: Send + Sync {
+    async fn find_by_id(&self, id: &SystemId) -> Result<Option<Role>, DomainError>;
+    async fn find_by_name(&self, name: &str) -> Result<Option<Role>, DomainError>;
+    async fn find_defaults(&self) -> Result<Vec<Role>, DomainError>;
+    async fn save(&self, role: &Role) -> Result<(), DomainError>;
+    async fn delete(&self, id: &SystemId) -> Result<(), DomainError>;
+}
+
+// --- GroupRepository ---
+
+#[async_trait]
+pub trait GroupRepository: Send + Sync {
+    async fn find_by_id(&self, id: &SystemId) -> Result<Option<Group>, DomainError>;
+    async fn find_by_user(&self, user_id: &SystemId) -> Result<Vec<Group>, DomainError>;
+    async fn save(&self, group: &Group) -> Result<(), DomainError>;
+    async fn delete(&self, id: &SystemId) -> Result<(), DomainError>;
+}
+
+// --- Auth ---
+
+#[async_trait]
+pub trait PasswordHasher: Send + Sync {
+    async fn hash(&self, password: &str) -> Result<PasswordHash, DomainError>;
+    async fn verify(&self, password: &str, hash: &PasswordHash) -> Result<bool, DomainError>;
+}
+
+#[async_trait]
+pub trait TokenIssuer: Send + Sync {
+    async fn issue(&self, user_id: &SystemId, role: &str) -> Result<String, DomainError>;
+    async fn verify(&self, token: &str) -> Result<(SystemId, String), DomainError>;
+}