refactor(server): split public, player and residual auth into capability routers (PR 5)

The last split PR of docs/website/API_V2_PLAN.md § Phase 2. public.routes.js,
player.routes.js and auth.routes.js are deleted; each group is now a directory
whose index.js owns the group gate and the mount table and declares no routes.
Every one of the 200 manifest routes is now in a capability router.

  public/  posts (2) wiki (4) pages (2) shard (12) site (4, group root)
  player/  account (8) shard (8) appeals (4), behind noindex + requireAuth
  auth/    login (2) register (1) invite (2) password (3) session (2, root)

No URL moves. All four gates zero-diff: routes.manifest.json (200 public + 2
internal), routes.guards.json, swagger-output.json (198 operations), and
docs/website/api-route-inventory.json was already in sync. 434 tests green.

Notes on the non-mechanical parts:

- public/index.js and auth/index.js carry no group gate, deliberately, and say
  so. The public surface is anonymous by contract (logged-out SPA, Discord bot,
  Android ShardStreamClient on /public/shard/stream); /auth is where a caller
  becomes authenticated. player/index.js gates on requireAuth only, never
  requireRole('player') — staff are a superset of players.
- GET /auth/me has a mount-order dependency: use('/me', meRouter) matches the
  bare /me, so the request runs meRouter's noindex + requireAuth and falls
  through. session.router.js must stay mounted last. Verified by the
  counterfactual — mounting it first still 401s but drops X-Robots-Tag, which
  no manifest or guards file can see.
- loginGuards moved to auth/loginGuards.js (frozen) rather than being copied
  into the three routers that spread it; sso.routes.js drops its duplicate.
- The :param shadowing check was re-run in dispatch order against the built
  stack: 86 routes, 64 literal, none shadowed. /public/wiki/{categories,tags}
  ahead of /:slug is the only ordering-sensitive pair.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/auth/sso.routes.js

@@ -2,17 +2,13 @@ const express = require('express')
 const { body } = require('express-validator')
 
 const ctrl = require('./sso.controller')
+const { loginGuards } = require('./loginGuards')
 const { requireAuth } = require('../../../auth/session.middleware')
-const { ssoStartLimiter, loginLimiter } = require('../../../middleware/rateLimit')
-const { slowLogin, backoffGuard } = require('../../../middleware/loginProtection')
+const { ssoStartLimiter } = require('../../../middleware/rateLimit')
 const validate = require('../../../middleware/validate')
 
 const ssoRouter = express.Router()
 
-// Same throttling stack the local login/TOTP endpoints use — the SSO TOTP step is
-// a code-guessing surface too (cheapest rejection first).
-const loginGuards = [backoffGuard, slowLogin, loginLimiter]
-
 // Public discovery — the login page reads this to render provider buttons.
 ssoRouter.get(
   '/providers',