Epic 2: Untangle the backend before the framework swap

Restructure the backend while it's still on Express so the framework swap later is a straight port instead of a rescue mission. The entry point stops being the thing everything imports from, multi-step writes become atomic, and auth gets some basic hardening. The app stays deployable after every ticket.