Tech debt: should Wire DI be hidden FastAPI-style?

Tracked in `roadmap.md` *Tech debts* as: **"fastapi wire under the hood?"**

Open question, not a decided task: should Google Wire's DI be hidden the way FastAPI hides its dependency injection, so a generated project's authors never edit `wire.go` or run `make generate` by hand?

Weigh against what the explicitness currently buys — `backend/wire.go` is where swapping an auth provider is a visible two-line change to `users.ProvideSessionIssuer`/`users.ProvideResolver`, which is a feature of the *Auth Provider Abstraction* design, not an accident.

Resolve the question before scoping any work.

Start with roadmap.md under “Tech debts” and inspect backend/wire.go, including the users.ProvideSessionIssuer/users.ProvideResolver swap points. Compare the benefits of explicit Google Wire setup with the FastAPI-style hiding described in the issue. Done means reaching a decision and defining a scoped follow-up task.

Written by the indexing model from the issue text.