#39 Refactor: split src/index.ts (4637 lines) into routes, server, and client modules

Pure move, no behavior change. src/index.ts goes from 4637 lines to 53 (Env, AppSession re-export, thin fetch dispatcher).

• src/server/auth.ts — cookies, session, CORS, gates (requireAccess/requireLogin), turnConflict, resolveAuth/resolveSid, sessionJson, RouteCtx
• src/routes/*.ts (8 files) — each exports one handle*(req, ctx): Response | null; fetch tries them in order, 404 fallthrough preserved
• src/server/page.ts — appDoc + page() assembly
• src/client/*.ts (11 files) — head, core helpers, and feature chunks (state, transcript, history, pane, settings-a/b, attachments, agent, tabs)

Verification:

• served / HTML is byte-identical before/after (diffed 124,699 bytes)
• npm run lint clean, 353/353 tests pass, check-inline-js OK (104,595 chars, 1 block)
• no import cycles: routes import runtime only from server/auth + domain modules; index is only imported as import type

---

Summary by cubic

Splits the 4,637-line src/index.ts into route, server, and client modules. src/index.ts drops to 53 lines (Env type, AppSession re-export, thin fetch dispatcher), and behavior is unchanged.

Refactors

• src/routes/*.ts (8 files) export one handle*(req, ctx) each; the dispatcher tries them in order, preserving the 404 fallthrough. /api/github/branches lives in github-repos.ts since it is a GitHub API call, not a just-git one.
• src/server/ holds auth, session, and page-assembly helpers; the 11 src/client/*.ts chunks replace the inline template literal, assembled in a documented order by page.ts.
• / HTML is byte-identical before/after; lint clean, 353/353 tests pass, and no import cycles were introduced.