Refactor oversized modules and consolidate cross-cutting concerns

## Summary

A codebase design-smell review identified several god modules, duplicated auth logic, and scattered operational guidance. Part of this is addressed on branch `doc/code_smell_remediation` ([compare](https://github.com/Agent-Hellboy/mcp-runtime/compare/main...doc/code_smell_remediation)); the rest should be tracked as follow-up work.

## Already addressed (see `doc/code_smell_remediation`)

- [ ] **Registry forward-auth deduplication** — Wire `registry.HandleAuthz` as the single implementation; move env-derived `AuthzConfig` into `services/api/registry/config.go`; thin `registry_authz.go` to adapter glue only.
- [ ] **API route registration** — Extract mux wiring from `services/api/main.go` into `services/api/routes.go` so `main` stays bootstrap-only.
- [ ] **Shared errx structured logging** — Add `pkg/errx.LogrKV()` and use it from operator + CLI instead of duplicated field extraction.
- [ ] **Ingress class constant** — Operator ingress reconciler uses `DefaultIngressClass` instead of hard-coded `"traefik"` literals.
- [ ] **Troubleshooting skill completeness** — Restore the full failure-mode checklist in `.codex/skills/mcp-runtime-troubleshooting/reference.md` (content was lost when `AGENTS.md` was slimmed).

## Recommended follow-up (not yet done)

### High impact

1. **Split `services/ui/main.go` (~1.3k lines)**
Separate `session`, `auth`, `proxy`, and `static` packages; inject stores/hooks from a small `main`. Reduces security-change blast radius.

2. **Split `services/api/internal/runtimeapi/deployments.go` (~1.4k lines)**
Extract K8s provisioning (namespace, Traefik watch, pull secrets, NetworkPolicy) into e.g. `runtimeapi/k8sprovision/`; keep HTTP handlers thin.

3. **Finish registry authz test ownership**
Add unit tests under `services/api/registry/` for `config.go` and `PrincipalCanAccessRegistryPath`; consider moving `authz_test.go` cases that only exercise registry behavior.

### Medium impact

4. **Split `internal/cli/setup/platform/*`**
`analytics.go`, `tls.go`, and `deploy.go` are 700–1,600 lines each; `SetupDeps` has 20+ function fields. Split by phase (registry / TLS / sentinel) with narrow interfaces.

5. **Thin fat CLI managers**
`internal/cli/registry/manager.go`, `server/manager.go`, `platformapi/client.go`, `cluster/manager.go` — finish client-go migration and split by subcommand concern.

6. **Centralize grant/session validation**
Today: `api/v1alpha1/validation.go`, `runtimeapi/grant_handlers.go`, CLI `access/`, `platformapi/client.go`. Single validator in `pkg/access` (or similar) called from API, CLI, and optional CRD webhook.

7. **Gateway request pipeline**
Refactor `services/mcp-gateway/proxy.go` `handleGateway` into explicit stages: authn → policy load → authorize → proxy → audit.

8. **Doctor / docs single source**
`cluster doctor` remedies overlap troubleshooting skill and `docs/`; share check definitions or generated remedy text to avoid drift.

### Low impact / hygiene

9. **`inspirations/` tree** — Gitignored but large (~20k LOC); confuses agents and scans. Move to separate repo, submodule, or `docs/reference/` with a clear “not built” note.

10. **Ingress class** — Ensure all operator paths use `constants.DefaultIngressClass` (reconcile + annotations).

## Acceptance criteria (for closing the umbrella issue)

- No duplicate registry authz implementation in `main` package.
- `services/api/main.go` under ~400 lines (bootstrap + handlers only).
- UI, deployments, and setup platform each split into packages with clear ownership.
- Grant validation has one canonical implementation with API/CLI tests pointing at it.
- Troubleshooting skill `reference.md` stays in sync when new failure modes are documented in `AGENTS.md` or `cluster doctor`.

## References

- Design-smell review (agent session, May 2026)
- Branch: `doc/code_smell_remediation`
- Related skills: `mcp-runtime-troubleshooting`, `mcp-runtime-platform-public`, `repo-guidance-sync`