fix(presentation): extract 12 handler violations to use cases

- TokenService port + JwtTokenService adapter; login/refresh return LoginResult
- delete get_token (dup of login); create_tokens helper removed
- type UpdateChannelRequest schedule_config/recycle_policy (no serde_json::Value)
- update_settings returns updated Vec; handler calls one use case
- config use case in application::config; handler maps DTO only
- SyncStatusEntry moved to api-types w/ From<LibrarySyncLogEntry>
- trigger_sync: Conflict error, drop sync_trigger.send from handler
- UpsertProviderCommand.config accepts Value; serialization in use case
- get_current_broadcast returns BroadcastWithChannel; one call
- get_stream_url resolves broadcast internally; handler single call

crates/domain/src/ports/auth.rs

@@ -1,8 +1,16 @@
 use crate::errors::DomainResult;
+use crate::models::User;
+use crate::value_objects::UserId;
 
-// Intentionally sync: CPU-bound hashing should run on a blocking thread pool
 pub trait AuthService: Send + Sync {
     fn hash_password(&self, password: &str) -> DomainResult<String>;
 
     fn verify_password(&self, password: &str, hash: &str) -> DomainResult<bool>;
 }
+
+pub trait TokenService: Send + Sync {
+    fn create_access_token(&self, user: &User) -> DomainResult<String>;
+    fn create_refresh_token(&self, user: &User) -> DomainResult<String>;
+    fn validate_refresh_token(&self, token: &str) -> DomainResult<UserId>;
+    fn token_expiry_secs(&self) -> u64;
+}

crates/domain/src/ports/mod.rs

@@ -11,7 +11,7 @@ pub mod transcode;
 pub mod user;
 
 pub use activity::{ActivityLogCommand, ActivityLogQuery};
-pub use auth::AuthService;
+pub use auth::{AuthService, TokenService};
 pub use channel::{ChannelCommand, ChannelQuery};
 pub use events::{DomainEvent, EventConsumer, EventHandler, EventPublisher};
 pub use library::{LibraryCommand, LibraryQuery, LibrarySyncAdapter};

crates/domain/src/testing/noops.rs

@@ -114,6 +114,49 @@ impl ActivityLogQuery for NoopActivityLog {
     }
 }
 
+pub struct NoopTokenService;
+
+impl NoopTokenService {
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+impl Default for NoopTokenService {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl crate::ports::TokenService for NoopTokenService {
+    fn create_access_token(
+        &self,
+        _user: &crate::models::User,
+    ) -> crate::errors::DomainResult<String> {
+        Ok("noop-access-token".to_string())
+    }
+
+    fn create_refresh_token(
+        &self,
+        _user: &crate::models::User,
+    ) -> crate::errors::DomainResult<String> {
+        Ok("noop-refresh-token".to_string())
+    }
+
+    fn validate_refresh_token(
+        &self,
+        _token: &str,
+    ) -> crate::errors::DomainResult<crate::value_objects::UserId> {
+        Err(crate::errors::DomainError::Unauthenticated(
+            "NoopTokenService".to_string(),
+        ))
+    }
+
+    fn token_expiry_secs(&self) -> u64 {
+        3600
+    }
+}
+
 pub struct NoopLibrarySync;
 
 impl NoopLibrarySync {