refactor(backend): extract types, constants, and guards from index.ts (phase 0) (#730)

* refactor(backend): extract types, constants, and guards from index.ts (phase 0)

Additive, behavior-preserving first step of the modular backend refactor.
Moves purely static artifacts out of backend/src/index.ts so later phases can
extract routes and middleware without touching shared symbols.

New modules:
- types/express.ts: Express Request augmentation
- helpers/constants.ts: PORT, password policy, label colors, cookie names,
  MFA TTLs, hot-path cache TTLs
- helpers/proxyExemptPaths.ts: PROXY_EXEMPT_PREFIXES + isProxyExemptPath
- helpers/cookies.ts: isSecureRequest, getCookieOptions
- helpers/policyGate.ts: buildPolicyGateOptions, runPolicyGate,
  triggerPostDeployScan
- middleware/permissions.ts: ROLE_PERMISSIONS, checkPermission,
  requirePermission
- middleware/tierGates.ts: requirePaid, requireAdmiral, requireAdmin,
  requireNodeProxy, requireScheduledTaskTier + effectiveTier/Variant

index.ts shrinks by ~260 lines; no runtime behavior changes. All 64 vitest
files and 1,278 tests pass.

* refactor(backend): drop unused imports left after phase 0 extraction

LicenseTier, LicenseVariant, DIGEST_CACHE_TTL_MS, and isProxyExemptPath
were imported into index.ts but no longer referenced there after the
phase 0 move; CI lint flagged them as errors.

isProxyExemptPath will be re-imported in phase 1 when the JSON parser
bypass and nodeContext middleware get extracted. Silence the
no-namespace warning on the Express augmentation since the namespace
syntax is required for TypeScript module augmentation.

backend/src/types/express.ts

@@ -0,0 +1,26 @@
+import type { UserRole, ApiTokenScope } from '../services/DatabaseService';
+import type { LicenseTier, LicenseVariant } from '../services/LicenseService';
+
+// Extend Express Request type for user and node context.
+// This file is imported for its side effects only (ambient declaration).
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace -- Express type augmentation requires namespace syntax
+  namespace Express {
+    interface Request {
+      user?: { username: string; role: UserRole; userId: number };
+      nodeId: number;
+      apiTokenScope?: ApiTokenScope;
+      rawBody?: Buffer;
+      /** License tier asserted by the main instance on proxied requests. Only set for trusted node_proxy tokens. */
+      proxyTier?: LicenseTier;
+      /** License variant asserted by the main instance on proxied requests. Only set for trusted node_proxy tokens. */
+      proxyVariant?: LicenseVariant;
+      /** User ID carried by a scoped `mfa_pending` token. Only set while the user is completing the MFA challenge. */
+      mfaPendingUserId?: number;
+      /** True when the pending MFA session originated from an SSO login (LDAP or OIDC) rather than a password login. */
+      mfaPendingSso?: boolean;
+    }
+  }
+}
+
+export {};