[Story]: config/mod.rs and repo.rs are split by domain

### Story Statement
As an engineer changing configuration or persistence, I want `config/mod.rs` (2,010 LoC) and `api-key/src/repo.rs` (2,950 LoC) split by domain, so that each concern is readable on its own.

### Real Intent
Third and fourth largest files. Both are touched by nearly every feature, so their size taxes all work.

### Background and Context
`config/mod.rs` holds every config struct for every service. `repo.rs` holds every hand-written query, including the ADR-0038-exception paths.

### Source of truth (links)
- Measured 2026-08-26
- ADR-0038 (cratestack is the sanctioned database API)

### Acceptance Criteria
- [ ] `config` split per service/domain, with the loader and interpolation separated
- [ ] `repo.rs` split by aggregate
- [ ] The ADR-0038 exception paths stay together and keep their explanatory comments verbatim
- [ ] `just it-tests` passes unchanged

### Out of Scope
Migrating anything to cratestack - explicitly out of scope per ADR-0038.

### Dependencies and Blockers
Scheduled after R2. Depends on the `lib.rs` split landing first to avoid overlapping conflicts.

### Assumptions
Team capacity is 6 engineers; estimates are ideal dev-days for one engineer.

### Implementation Notes
The advisory-lock and CAS paths (`ensure_active_signing_key`, `rotate_exchange_refresh_token`, `consume_device_authorization`, `consume_authorization_code`) carry load-bearing comments. Move them intact.

### Test Expectations
`just it-tests` with Postgres. These paths have real concurrency semantics that only the DB-backed tests exercise.

### Verification evidence
- [ ] Automated test added and proven to fail before the fix
- [ ] `just all-checks` green
- [ ] Every new or changed `src` file is <= 200 LoC

### Human accountable owner
@stephane-segning

### AI Usage Declaration
Story drafted with AI assistance from a verified repo audit.
Structure and estimates drafted with AI from a verified repository audit (file
line counts, config keys, and dependency state were read from the actual tree,
not assumed). A human owns intent, scope, and the release commitment.

### Human verification completed
- [ ] I can explain this work without referring to the AI-generated text
- [ ] Acceptance criteria are testable
- [ ] Source of truth is a real link, not boilerplate

Governance: https://adorsys-gis.github.io/ai-governance/