refactor(api): split Axum handlers into handler/service/repo modules

Keep the REST contract; move domain logic out of route files so checkout, fulfillment, and identity can be reused across customer, shop, and admin surfaces.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/models.rs

@@ -27,11 +27,10 @@ pub enum ShopStatus {
     Suspended,
 }
 
-#[derive(Debug, Serialize, sqlx::FromRow)]
+#[derive(Debug, Clone, sqlx::FromRow)]
 pub struct User {
     pub id: Uuid,
     pub email: String,
-    #[serde(skip_serializing)]
     pub password_hash: String,
     pub display_name: String,
     pub role: UserRole,
@@ -40,6 +39,35 @@ pub struct User {
     pub created_at: DateTime<Utc>,
 }
 
+/// Public user JSON. Never includes `password_hash`.
+#[derive(Debug, Serialize)]
+pub struct UserPublic {
+    pub id: Uuid,
+    pub email: String,
+    pub display_name: String,
+    pub role: UserRole,
+    pub shop_id: Option<Uuid>,
+    pub locale: String,
+    pub created_at: DateTime<Utc>,
+}
+
+impl From<User> for UserPublic {
+    fn from(u: User) -> Self {
+        Self {
+            id: u.id,
+            email: u.email,
+            display_name: u.display_name,
+            role: u.role,
+            shop_id: u.shop_id,
+            locale: u.locale,
+            created_at: u.created_at,
+        }
+    }
+}
+
+pub const USER_COLUMNS: &str =
+    "id, email, password_hash, display_name, role, shop_id, locale, created_at";
+
 #[derive(Debug, Serialize, sqlx::FromRow)]
 pub struct Shop {
     pub id: Uuid,
@@ -213,3 +241,18 @@ pub struct Invoice {
     pub issued_at: Option<DateTime<Utc>>,
     pub created_at: DateTime<Utc>,
 }
+
+#[derive(Debug, Clone, Serialize, sqlx::FromRow)]
+pub struct AddressBookEntry {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub recipient: String,
+    pub phone: String,
+    pub country: String,
+    pub region: String,
+    pub city: String,
+    pub line1: String,
+    pub postal_code: String,
+    pub is_default: bool,
+    pub created_at: DateTime<Utc>,
+}