fix(presentation): extract 12 handler violations to use cases

- TokenService port + JwtTokenService adapter; login/refresh return LoginResult
- delete get_token (dup of login); create_tokens helper removed
- type UpdateChannelRequest schedule_config/recycle_policy (no serde_json::Value)
- update_settings returns updated Vec; handler calls one use case
- config use case in application::config; handler maps DTO only
- SyncStatusEntry moved to api-types w/ From<LibrarySyncLogEntry>
- trigger_sync: Conflict error, drop sync_trigger.send from handler
- UpsertProviderCommand.config accepts Value; serialization in use case
- get_current_broadcast returns BroadcastWithChannel; one call
- get_stream_url resolves broadcast internally; handler single call

crates/adapters/auth/Cargo.toml

@@ -13,6 +13,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+uuid = { workspace = true }
 
 # JWT deps
 jsonwebtoken = { workspace = true, optional = true }

crates/adapters/auth/src/jwt.rs

@@ -205,6 +205,51 @@ impl JwtValidator {
             .map_err(|_| JwtError::InvalidFormat)?;
         Ok(token_data.claims)
     }
+
+    pub fn expiry_hours(&self) -> u64 {
+        self.config.expiry_hours
+    }
+}
+
+pub struct JwtTokenService {
+    validator: JwtValidator,
+}
+
+impl JwtTokenService {
+    pub fn new(validator: JwtValidator) -> Self {
+        Self { validator }
+    }
+}
+
+impl domain::ports::TokenService for JwtTokenService {
+    fn create_access_token(&self, user: &domain::User) -> domain::DomainResult<String> {
+        self.validator.create_token(user).map_err(|e| {
+            domain::DomainError::InfrastructureError(format!("Failed to create access token: {e}"))
+        })
+    }
+
+    fn create_refresh_token(&self, user: &domain::User) -> domain::DomainResult<String> {
+        self.validator.create_refresh_token(user).map_err(|e| {
+            domain::DomainError::InfrastructureError(format!(
+                "Failed to create refresh token: {e}"
+            ))
+        })
+    }
+
+    fn validate_refresh_token(&self, token: &str) -> domain::DomainResult<domain::UserId> {
+        let claims = self.validator.validate_refresh_token(token).map_err(|e| {
+            tracing::debug!("Refresh token validation failed: {:?}", e);
+            domain::DomainError::Unauthenticated("Invalid refresh token".to_string())
+        })?;
+        let user_id: uuid::Uuid = claims.sub.parse().map_err(|_| {
+            domain::DomainError::Unauthenticated("Invalid user ID in token".to_string())
+        })?;
+        Ok(domain::UserId::from(user_id))
+    }
+
+    fn token_expiry_secs(&self) -> u64 {
+        self.validator.expiry_hours() * 3600
+    }
 }
 
 impl std::fmt::Debug for JwtValidator {

crates/adapters/auth/src/lib.rs

@@ -6,4 +6,4 @@ pub mod jwt;
 pub use password::PasswordAuthService;
 
 #[cfg(feature = "jwt")]
-pub use jwt::{JwtClaims, JwtConfig, JwtError, JwtValidator};
+pub use jwt::{JwtClaims, JwtConfig, JwtError, JwtTokenService, JwtValidator};