clean(presentation): strip comments, kill dead code, extract constants

- remove all doc/inline comments
- delete unused ApiError variants (AuthRequired, NotImplemented) and helpers (internal, not_implemented)
- prefix lifetime-only AppState fields with _ to suppress dead_code warning
- extract magic numbers: TICK_INTERVAL_SECS, EXPIRY_THRESHOLD_HOURS, POLL_INTERVAL_SECS, EVENT_BUS_CAPACITY, DEFAULT_ACTIVITY_LIMIT, DEFAULT_SEARCH_LIMIT, etc
- replace inline serde_json::json! in sync_status with typed SyncStatusEntry
- fix mid-file import in schedule handler
- fix extractors: strip_prefix instead of magic offset 6
- fix unreachable pattern in wire_repositories with cfg guard
- use eq_ignore_ascii_case for content-type header check

crates/presentation/src/extractors.rs

@@ -1,7 +1,3 @@
-//! Auth extractors for API handlers.
-//!
-//! Provides `CurrentUser`, `OptionalCurrentUser`, and `AdminUser` extractors.
-
 use axum::extract::FromRequestParts;
 use axum::http::request::Parts;
 use domain::User;
@@ -9,7 +5,6 @@ use domain::User;
 use crate::errors::ApiError;
 use crate::state::AppState;
 
-/// Extracted current user from JWT Bearer token.
 pub struct CurrentUser(pub User);
 
 impl FromRequestParts<AppState> for CurrentUser {
@@ -37,9 +32,6 @@ impl FromRequestParts<AppState> for CurrentUser {
     }
 }
 
-/// Optional current user — returns None instead of error when auth missing.
-///
-/// Checks `Authorization: Bearer <token>` first; falls back to `?token=<jwt>`.
 pub struct OptionalCurrentUser(pub Option<User>);
 
 impl FromRequestParts<AppState> for OptionalCurrentUser {
@@ -56,8 +48,8 @@ impl FromRequestParts<AppState> for OptionalCurrentUser {
             }
             let query_token = parts.uri.query().and_then(|q| {
                 q.split('&')
-                    .find(|seg| seg.starts_with("token="))
-                    .map(|seg| seg[6..].to_owned())
+                    .find_map(|seg| seg.strip_prefix("token="))
+                    .map(|v| v.to_owned())
             });
             if let Some(token) = query_token {
                 let user = validate_jwt_token(&token, state).await.ok();
@@ -74,7 +66,6 @@ impl FromRequestParts<AppState> for OptionalCurrentUser {
     }
 }
 
-/// Extracted admin user — returns 403 if user is not an admin.
 pub struct AdminUser(pub User);
 
 impl FromRequestParts<AppState> for AdminUser {
@@ -92,7 +83,6 @@ impl FromRequestParts<AppState> for AdminUser {
     }
 }
 
-/// Authenticate via JWT Bearer token from `Authorization` header.
 #[cfg(feature = "auth-jwt")]
 async fn try_jwt_auth(parts: &mut Parts, state: &AppState) -> Result<User, ApiError> {
     use axum::http::header::AUTHORIZATION;
@@ -113,7 +103,6 @@ async fn try_jwt_auth(parts: &mut Parts, state: &AppState) -> Result<User, ApiEr
     validate_jwt_token(token, state).await
 }
 
-/// Validate a raw JWT string and return the corresponding `User`.
 #[cfg(feature = "auth-jwt")]
 pub(crate) async fn validate_jwt_token(token: &str, state: &AppState) -> Result<User, ApiError> {
     let validator = state