Move the runtime surface into the runtime module

Part of #37. Came out of an ideation session, not a scoped request.

Everything a generated project needs at runtime moves under the new module — starting with today's top-level `auth/` — and `templates/` imports are repointed at the new path. The rule being captured here is that the module is the single home for production-facing code: if a generated project links it, it lives there; if it only runs at development time, it stays in the CLI tree.

Start by mapping the current top-level auth/ code and the templates/ imports that reference it, then compare them with the proposed runtime module and CLI tree. Define the production-facing boundary before moving files, repoint imports, and verify that generated projects use the new path while development-only code remains in the CLI tree.

Written by the indexing model from the issue text.