Title: Convert auth module from callbacks to async/await

Description:
The auth module (src/auth/) uses callback-style async. Convert to async/await for readability and consistency with the rest of the codebase.

Files to modify:
- src/auth/service.ts
- src/auth/middleware.ts
- src/auth/types.ts (only if type changes needed)

Transformation:
- Replace callback-based functions with async/await
- Update callers if signatures change
- Preserve behavior exactly

Acceptance criteria:
- [ ] All functions in service.ts use async/await
- [ ] All functions in middleware.ts use async/await
- [ ] Existing tests pass unchanged (behavior preserved)
- [ ] No new dependencies
- [ ] No changes outside src/auth/

Tests required:
- Existing tests must pass
- No new tests needed (behavior preserved)

Out of scope:
- Other modules
- Type definition changes (unless required)
- Documentation (separate issue)

Labels: agent-ok, refactor

Migration: auth module callbacks → async/await
Date: 2026-08-30
Issue: #142
PR: #143

Agent metrics:
- Time: 25 min
- Credits: 150
- Files changed: 3
- Lines changed: +45 -38

Review:
- 15-item checklist: all pass (after 1 iteration)
- 1 missed callback caught in review
- CI: green

Total dev time: 15 min (review + iterate)
Manual estimate: 2 hours
Time saved: ~1h45m

Lessons:
- Issue was specific enough; agent succeeded first try.
- Review caught one missed callback (good).
- Re-delegation not needed (clean PR).

Next migrations:
- Convert user module (similar size)
- Convert order module (larger, may need to split)