[Ticket]: split config/mod.rs (2207 lines, 33 types) — its LoC baseline was raised twice in one night

## Type

Task (maintainability — the LoC gate has been pointing at this)

## Summary

`crates/lightbridge-authz-core/src/config/mod.rs` is **2207 lines holding 33 top-level types**. Its LoC-gate baseline has been raised **twice in one night** — 2173 -> 2193 (#637) -> 2207 (#642) — both times to accommodate a routine config-field addition.

The gate is not in the way here. It is telling us the file is too big, and we have been answering by moving the bar.

## Intent

Stop raising this baseline. Split the file so a config addition lands in a small, focused module.

## Source of truth (links)

- #637, #642 — the two consecutive bumps
- #643 — the sibling ticket (`Oauth2: Default`), which reduces the *ripple* of a config change but not this file's own growth
- `.github/actions/loc-gate/loc-gate.sh` — "Files already over the ceiling are grandfathered against a committed baseline: they may be touched but must not grow past the count recorded there"

## Current Behavior

One module owns every configuration type for every component: server blocks, `Oauth2` and its client registry, `Redis`, `UsageService`, `ScopeAuthority`, `JwtSigning`, budget/quota catalogues, the interpolation layer, and their tests' fixtures. 2207 lines, 33 top-level types, 200-line ceiling.

Each addition forces a baseline bump, and each bump makes the next one feel routine. That is the ratchet worth stopping.

## Expected Behavior

`config/` becomes a directory of focused modules — plausibly `server.rs`, `oauth2.rs`, `clients.rs`, `storage.rs` (redis/db), `services.rs` (usage/scope-authority), `interpolation.rs` — each comfortably under the 200-line ceiling, with `mod.rs` re-exporting so **no downstream import path changes**.

## Acceptance Criteria

- [ ] Every new module is under the 200-line ceiling; `config/mod.rs` drops well under its baseline.
- [ ] **`.github/loc-baseline.json` loses the `config/mod.rs` entry entirely** rather than gaining a smaller number — the point is that the file is no longer grandfathered.
- [ ] **Zero behaviour change.** Pure moves plus `pub use`. No field renamed, no default altered, no serde attribute touched in the same commit.
- [ ] No downstream import path changes — `lightbridge_authz_core::config::Oauth2` still resolves.
- [ ] The config test suite passes unchanged, as evidence the move was behaviour-preserving. **If a test needed editing, the move was not pure** — split that into its own commit and say why.
- [ ] Doc comments move with their types. They are load-bearing here (several record incidents), so losing them to a careless move would be the worst outcome of this ticket.

## Out of Scope

Changing any config semantics, defaults or validation. Adding fields. `Oauth2: Default` (#643) — related, independent, and better done first so this split is not fighting a moving file.

## Technical Context

`docs/code-size-baseline.md` records the burn-down plan and the rules for a behaviour-preserving split; follow it rather than inventing an approach.

Sequencing: do #643 first. It shrinks the *blast radius* of a config change (~30 sites -> 1); this ticket shrinks the *file*. Doing this one first means #643 then edits a set of files that just moved, for no benefit.

## Risks

- **A "pure move" that quietly is not.** rustfmt re-wrapping, a lost `#[serde(...)]`, a doc comment orphaned from its type. Mitigation: the diff should be reviewable as moves; the config tests passing untouched is the evidence.
- **Churn cost.** 33 types across ~6 files makes `git blame` noisier for a while. Worth it: this is the second bump in a day.

## Test Plan

`cargo test -p lightbridge-authz-core` unchanged, plus the full workspace build, plus `loc-gate` passing with the `config/mod.rs` entry deleted.

## Verification evidence

`wc -l crates/lightbridge-authz-core/src/config/mod.rs` -> **2207**. `grep -c "^pub struct \|^pub enum "` -> **33**. Baseline history: 2173 (pre-#637) -> 2193 (#637) -> 2207 (#642), two bumps within roughly twelve hours, both for ordinary config additions.