feat: extract auth into @marketplaces/auth package, add backoffice admin provisioning spec

- ADR-0001: decision to extract auth/payment into shared @marketplaces/* packages
- Scaffold packages/auth, packages/payment; @marketplaces/auth now holds the real
  telegram (customer+admin QR/session) and ed25519 (future admin challenge/response)
  auth implementation, pushed to sources.vitanova.network/sdarbinyan/vitanovaPackages
- Rewire ~30 call sites to import from @marketplaces/auth; delete migrated originals
  from core/auth, core/admin-auth, services/, models/
- Replace environment coupling with AUTH_API_URL/TELEGRAM_BOT_USERNAME injection
  tokens and isDevMode(); wired as file:packages/auth pending registry publish
- Add TRACK-S §8: bootstrap per-marketplace admin login + marketplace-scoped
  sub-admin invite/role endpoints
- Build, arch:check:boundaries, and full test suite (103/103) all green

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/app.routes.ts

@@ -1,7 +1,8 @@
 import { Routes } from '@angular/router';
 import { languageGuard } from './guards/language.guard';
 import { projectEditorDirtyGuard } from './features/project-editor/guards/project-editor-dirty.guard';
-import { adminAuthGuard, requireAdminPermission } from './core/admin-auth/admin-auth.guard';
+import { adminAuthGuard } from '@marketplaces/auth';
+import { requireAdminPermission } from './core/admin-auth/admin-auth.guard';
 import { authRoutes } from './core/auth/auth.routes';
 import { adminCategoryDirtyGuard } from './features/admin/categories/guards/admin-category-dirty.guard';
 import { adminProductDirtyGuard } from './features/admin/products/guards/admin-product-dirty.guard';