refactor: group use cases into DDD bounded contexts

Flat use_cases/ (44 files) + monolithic commands.rs/queries.rs
split into diary/, movies/, watchlist/, import/, auth/, users/,
integrations/, search/, person/, federation/ — each with own
commands.rs, queries.rs, and use case modules.

Inline tests extracted to sibling tests/ dirs.

crates/application/src/auth/commands.rs

@@ -0,0 +1,14 @@
+use domain::models::UserRole;
+
+pub struct RegisterCommand {
+    pub email: String,
+    pub username: String,
+    pub password: String,
+    pub role: UserRole,
+}
+
+pub struct RegisterAndLoginCommand {
+    pub email: String,
+    pub username: String,
+    pub password: String,
+}

crates/application/src/auth/login.rs

@@ -0,0 +1,45 @@
+use chrono::{DateTime, Utc};
+use uuid::Uuid;
+
+use domain::{errors::DomainError, value_objects::Email};
+
+use crate::{auth::queries::LoginQuery, context::AppContext};
+
+pub struct LoginResult {
+    pub token: String,
+    pub user_id: Uuid,
+    pub email: String,
+    pub expires_at: DateTime<Utc>,
+}
+
+pub async fn execute(ctx: &AppContext, query: LoginQuery) -> Result<LoginResult, DomainError> {
+    let email = Email::new(query.email)?;
+    let user = ctx
+        .repos
+        .user
+        .find_by_email(&email)
+        .await?
+        .ok_or_else(|| DomainError::Unauthorized("Invalid credentials".into()))?;
+
+    let valid = ctx
+        .services
+        .password_hasher
+        .verify(&query.password, user.password_hash())
+        .await?;
+    if !valid {
+        return Err(DomainError::Unauthorized("Invalid credentials".into()));
+    }
+
+    let generated = ctx.services.auth.generate_token(user.id()).await?;
+
+    Ok(LoginResult {
+        token: generated.token,
+        user_id: user.id().value(),
+        email: user.email().value().to_string(),
+        expires_at: generated.expires_at,
+    })
+}
+
+#[cfg(test)]
+#[path = "tests/login.rs"]
+mod tests;

crates/application/src/auth/mod.rs

@@ -0,0 +1,5 @@
+pub mod commands;
+pub mod login;
+pub mod queries;
+pub mod register;
+pub mod register_and_login;

crates/application/src/auth/queries.rs

@@ -0,0 +1,4 @@
+pub struct LoginQuery {
+    pub email: String,
+    pub password: String,
+}

crates/application/src/auth/register.rs

@@ -0,0 +1,46 @@
+use domain::{
+    errors::DomainError,
+    models::User,
+    value_objects::{Email, Username},
+};
+
+use crate::{auth::commands::RegisterCommand, context::AppContext};
+
+const MIN_PASSWORD_LENGTH: usize = 8;
+
+pub async fn execute(ctx: &AppContext, cmd: RegisterCommand) -> Result<(), DomainError> {
+    if !ctx.config.allow_registration {
+        return Err(DomainError::Unauthorized("Registration is disabled".into()));
+    }
+
+    if cmd.password.len() < MIN_PASSWORD_LENGTH {
+        return Err(DomainError::ValidationError(
+            "Password must be at least 8 characters".into(),
+        ));
+    }
+
+    let email = Email::new(cmd.email)?;
+    let username = Username::new(cmd.username)?;
+
+    if ctx.repos.user.find_by_email(&email).await?.is_some() {
+        return Err(DomainError::ValidationError(
+            "Email already registered".into(),
+        ));
+    }
+
+    if ctx.repos.user.find_by_username(&username).await?.is_some() {
+        return Err(DomainError::ValidationError(
+            "Username already taken".into(),
+        ));
+    }
+
+    let hash = ctx.services.password_hasher.hash(&cmd.password).await?;
+    ctx.repos
+        .user
+        .save(&User::new(email, username, hash, cmd.role))
+        .await
+}
+
+#[cfg(test)]
+#[path = "tests/register.rs"]
+mod tests;

crates/application/src/auth/register_and_login.rs

@@ -0,0 +1,32 @@
+use domain::errors::DomainError;
+
+use crate::{
+    auth::commands::RegisterAndLoginCommand,
+    auth::{login, register},
+    context::AppContext,
+};
+
+pub async fn execute(
+    ctx: &AppContext,
+    cmd: RegisterAndLoginCommand,
+) -> Result<login::LoginResult, DomainError> {
+    register::execute(
+        ctx,
+        crate::auth::commands::RegisterCommand {
+            email: cmd.email.clone(),
+            username: cmd.username,
+            password: cmd.password.clone(),
+            role: domain::models::UserRole::Standard,
+        },
+    )
+    .await?;
+
+    login::execute(
+        ctx,
+        crate::auth::queries::LoginQuery {
+            email: cmd.email,
+            password: cmd.password,
+        },
+    )
+    .await
+}

crates/application/src/auth/tests/login.rs

@@ -0,0 +1,85 @@
+use std::sync::Arc;
+
+use domain::models::UserRole;
+use domain::testing::InMemoryUserRepository;
+
+use crate::{
+    auth::commands::RegisterCommand,
+    auth::queries::LoginQuery,
+    auth::{login, register},
+    test_helpers::TestContextBuilder,
+};
+
+async fn setup_user(ctx: &crate::context::AppContext, email: &str, password: &str) {
+    register::execute(
+        ctx,
+        RegisterCommand {
+            email: email.to_string(),
+            username: "testuser".to_string(),
+            password: password.to_string(),
+            role: UserRole::Standard,
+        },
+    )
+    .await
+    .unwrap();
+}
+
+#[tokio::test]
+async fn test_login_valid_credentials_returns_token() {
+    let users = InMemoryUserRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_users(Arc::clone(&users) as _)
+        .build();
+
+    setup_user(&ctx, "carol@example.com", "secret123").await;
+
+    let result = login::execute(
+        &ctx,
+        LoginQuery {
+            email: "carol@example.com".into(),
+            password: "secret123".into(),
+        },
+    )
+    .await
+    .unwrap();
+
+    assert!(!result.token.is_empty());
+    assert_eq!(result.email, "carol@example.com");
+}
+
+#[tokio::test]
+async fn test_login_wrong_password_fails() {
+    let users = InMemoryUserRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_users(Arc::clone(&users) as _)
+        .build();
+
+    setup_user(&ctx, "dave@example.com", "correct_password").await;
+
+    let result = login::execute(
+        &ctx,
+        LoginQuery {
+            email: "dave@example.com".into(),
+            password: "wrong_password".into(),
+        },
+    )
+    .await;
+
+    assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_login_unknown_email_fails() {
+    let ctx = TestContextBuilder::new().build();
+
+    let result = login::execute(
+        &ctx,
+        LoginQuery {
+            email: "nobody@example.com".into(),
+            password: "anything".into(),
+        },
+    )
+    .await;
+
+    assert!(result.is_err());
+}

crates/application/src/auth/tests/register.rs

@@ -0,0 +1,48 @@
+use std::sync::Arc;
+
+use domain::models::UserRole;
+use domain::ports::UserRepository;
+use domain::testing::InMemoryUserRepository;
+use domain::value_objects::Email;
+
+use crate::{auth::commands::RegisterCommand, auth::register, test_helpers::TestContextBuilder};
+
+fn cmd(email: &str) -> RegisterCommand {
+    RegisterCommand {
+        email: email.to_string(),
+        username: "alice".to_string(),
+        password: "password123".to_string(),
+        role: UserRole::Standard,
+    }
+}
+
+#[tokio::test]
+async fn test_register_creates_user() {
+    let users = InMemoryUserRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_users(Arc::clone(&users) as _)
+        .build();
+
+    register::execute(&ctx, cmd("alice@example.com"))
+        .await
+        .unwrap();
+
+    let email = Email::new("alice@example.com".into()).unwrap();
+    let user = users.find_by_email(&email).await.unwrap().unwrap();
+    assert_eq!(user.email().value(), "alice@example.com");
+    assert!(user.password_hash().value().starts_with("hashed:"));
+}
+
+#[tokio::test]
+async fn test_register_duplicate_email_fails() {
+    let users = InMemoryUserRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_users(Arc::clone(&users) as _)
+        .build();
+
+    register::execute(&ctx, cmd("bob@example.com"))
+        .await
+        .unwrap();
+    let result = register::execute(&ctx, cmd("bob@example.com")).await;
+    assert!(result.is_err(), "duplicate email should fail");
+}