[Story]: config/mod.rs and repo.rs are split by domain

### Story Statement
As an engineer changing configuration or persistence, I want `config/mod.rs` (2,010 LoC) and `api-key/src/repo.rs` (2,950 LoC) split by domain, so that each concern is readable on its own.

### Real Intent
Third and fourth largest files. Both are touched by nearly every feature, so their size taxes all work.

### Background and Context
`config/mod.rs` holds every config struct for every service. `repo.rs` holds every hand-written query, including the ADR-0038-exception paths.

### Source of truth (links)
- Measured 2026-08-26
- ADR-0038 (cratestack is the sanctioned database API)

### Acceptance Criteria
- [ ] `config` split per service/domain, with the loader and interpolation separated
- [ ] `repo.rs` split by aggregate
- [ ] The ADR-0038 exception paths stay together and keep their explanatory comments verbatim
- [ ] `just it-tests` passes unchanged

### Out of Scope
Migrating anything to cratestack - explicitly out of scope per ADR-0038.

### Dependencies and Blockers
Scheduled after R2. Depends on the `lib.rs` split landing first to avoid overlapping conflicts.

### Assumptions
Team capacity is 6 engineers; estimates are ideal dev-days for one engineer.

### Implementation Notes
The advisory-lock and CAS paths (`ensure_active_signing_key`, `rotate_exchange_refresh_token`, `consume_device_authorization`, `consume_authorization_code`) carry load-bearing comments. Move them intact.

### Test Expectations
`just it-tests` with Postgres. These paths have real concurrency semantics that only the DB-backed tests exercise.

### Verification evidence
- [ ] Automated test added and proven to fail before the fix
- [ ] `just all-checks` green
- [ ] Every new or changed `src` file is <= 200 LoC

### Human accountable owner
@stephane-segning

### AI Usage Declaration
Story drafted with AI assistance from a verified repo audit.
Structure and estimates drafted with AI from a verified repository audit (file
line counts, config keys, and dependency state were read from the actual tree,
not assumed). A human owns intent, scope, and the release commitment.

### Human verification completed
- [ ] I can explain this work without referring to the AI-generated text
- [ ] Acceptance criteria are testable
- [ ] Source of truth is a real link, not boilerplate

Governance: https://adorsys-gis.github.io/ai-governance/

Read config/mod.rs, api-key/src/repo.rs, and ADR-0038 first, then review the lib.rs split dependency and the named advisory-lock and CAS paths. Map service/domain configuration and aggregate query boundaries while keeping the exception comments intact. Done means the acceptance criteria are met, every changed src file is at most 200 LoC, and just it-tests plus just all-checks pass with Postgres.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.