[AZ-485] Add Public API barrels + STC-ARCH-01 (F4 close)

Closes architecture baseline finding F4. Every component now exposes
its Public API through `src/<component>/index.ts`; cross-component
imports go through the barrel. `scripts/check-arch-imports.mjs` plus
`STC-ARCH-01` in the static profile enforce the rule; tests in
`tests/architecture_imports.test.ts` cover AC-4/AC-5 + 2 exemption
cases. One F3-pending exemption (`classColors`) is documented in 5
places (barrel, consumer, script, doc, test) to avoid a circular
import.

Phase B cycle 1 batch 1 of 2 (epic AZ-447). Batch 2 is AZ-486
(endpoint builders) — blocked on this commit landing.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/helpers/auth.ts

@@ -1,4 +1,4 @@
-import { setToken } from '../../src/api/client'
+import { setToken } from '../../src/api'
 
 // Stand-in for the full login flow. Tests that need an authenticated request
 // call `seedBearer(token)` before the request fires; `clearBearer()` is

tests/helpers/navigate.ts

@@ -1,5 +1,5 @@
 import { vi, type MockedFunction } from 'vitest'
-import { setNavigateToLogin } from '../../src/api/client'
+import { setNavigateToLogin } from '../../src/api'
 
 // Replaces the production `navigateToLoginImpl` accessor (autodev Step 4 / C06)
 // with a Vitest spy. Tests assert "redirect was invoked" via the returned

tests/helpers/render.tsx

@@ -2,8 +2,8 @@ import type { ReactElement, ReactNode } from 'react'
 import { render, type RenderOptions, type RenderResult } from '@testing-library/react'
 import { MemoryRouter } from 'react-router-dom'
 import { I18nextProvider } from 'react-i18next'
-import i18n from '../../src/i18n/i18n'
-import { AuthProvider } from '../../src/auth/AuthContext'
+import i18n from '../../src/i18n'
+import { AuthProvider } from '../../src/auth'
 
 export interface RenderWithProvidersOptions extends RenderOptions {
   /** Initial route(s) for the in-memory router. Defaults to ['/']. */