feat: extract auth into @marketplaces/auth package, add backoffice admin provisioning spec

- ADR-0001: decision to extract auth/payment into shared @marketplaces/* packages
- Scaffold packages/auth, packages/payment; @marketplaces/auth now holds the real
  telegram (customer+admin QR/session) and ed25519 (future admin challenge/response)
  auth implementation, pushed to sources.vitanova.network/sdarbinyan/vitanovaPackages
- Rewire ~30 call sites to import from @marketplaces/auth; delete migrated originals
  from core/auth, core/admin-auth, services/, models/
- Replace environment coupling with AUTH_API_URL/TELEGRAM_BOT_USERNAME injection
  tokens and isDevMode(); wired as file:packages/auth pending registry publish
- Add TRACK-S §8: bootstrap per-marketplace admin login + marketplace-scoped
  sub-admin invite/role endpoints
- Build, arch:check:boundaries, and full test suite (103/103) all green

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/components/header/header.component.spec.ts

@@ -6,7 +6,7 @@ import { of } from 'rxjs';
 import { BootstrapConfig } from '../../shared/models/config';
 import { CONFIG_PROVIDER } from '../../core/config/config-provider.token';
 import { ConfigService } from '../../core/config/config.service';
-import { AuthService } from '../../services/auth.service';
+import { AuthService, AUTH_API_URL } from '@marketplaces/auth';
 import { HeaderComponent } from './header.component';
 
 function makeBootstrap(): BootstrapConfig {
@@ -52,6 +52,7 @@ describe('HeaderComponent profile control (login/logout gating regression)', ()
         provideHttpClient(),
         provideHttpClientTesting(),
         { provide: CONFIG_PROVIDER, useValue: { loadBootstrap: () => of(makeBootstrap()) } },
+        { provide: AUTH_API_URL, useValue: 'https://test.local' },
         { provide: AuthService, useValue: fakeAuth },
       ],
     });

src/app/components/header/header.component.ts

@@ -14,7 +14,7 @@ import { FeatureConfigService } from '../../core/config/feature-config.service';
 import { DEFAULT_HEADER_CONFIG, DEFAULT_USER_EXPERIENCE_CONFIG } from '../../shared/models/config';
 import { StaticPageResolverService } from '../../core/config/static-page-resolver.service';
 import { IconComponent } from '../../shared/ui/icon/icon.component';
-import { AuthService } from '../../services/auth.service';
+import { AuthService } from '@marketplaces/auth';
 import { TelegramLoginComponent } from '../telegram-login/telegram-login.component';
 
 @Component({

src/app/components/telegram-login/telegram-login.component.ts

@@ -1,12 +1,10 @@
 import { Component, ChangeDetectionStrategy, Input, Injector, Signal, inject, effect, OnDestroy, OnInit } from '@angular/core';
 import { Router } from '@angular/router';
-import { AuthService } from '../../services/auth.service';
-import { AdminAuthService } from '../../core/admin-auth/admin-auth.service';
+import { AuthService, AdminAuthService, AuthSession } from '@marketplaces/auth';
 import { LanguageService } from '../../services/language.service';
 import { TranslatePipe } from '../../i18n/translate.pipe';
 import { QrLoginEngine } from '../../shared/qr-login/qr-login.engine';
 import { QrLoginAdapter, QrLoginStatus } from '../../shared/qr-login/qr-login.model';
-import { AuthSession } from '../../models/auth.model';
 import { IconComponent } from '../../shared/ui/icon/icon.component';
 
 /**