feat(08-06): create backend/api/auth/ package — Task 1

- Create api/auth/shared.py: limiter, all Pydantic request models, _set_refresh_cookie, _user_dict
- Create api/auth/tokens.py: register, login, refresh, logout, logout-all, me, quota, preferences handlers
- Create api/auth/totp.py: totp/setup, totp/enable, totp DELETE handlers (CR-02, CR-03 preserved)
- Create api/auth/password.py: change-password, password-reset, password-reset/confirm handlers (CR-01 preserved)
- Create api/auth/__init__.py: router aggregator with prefix=/api/auth; re-exports limiter
- Rename auth.py monolith to auth_OLD_REMOVE_IN_TASK_2.py (deleted in Task 2 after tests pass)
- All 15 routes confirmed; limiter re-export verified; skip_token_hash calls preserved verbatim

backend/api/auth/__init__.py

@@ -0,0 +1,18 @@
+"""
+Auth API package aggregator.
+
+Combines tokens_router, totp_router, and password_router under the /api/auth prefix.
+Re-exports `limiter` from shared.py so that:
+  from api.auth import limiter
+continues to work in main.py and the 5 test files without modification (T-08-06-01).
+"""
+from fastapi import APIRouter
+from api.auth.tokens import router as tokens_router
+from api.auth.totp import router as totp_router
+from api.auth.password import router as password_router
+from api.auth.shared import limiter  # re-export: "from api.auth import limiter" still works
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+router.include_router(tokens_router)
+router.include_router(totp_router)
+router.include_router(password_router)