[codex] align server auth Effect services - #3180

All clear. This​This PR refactors the auth-layerror handling and service definitions to follow the Effect service conventions, and the changes are consistent with them.

Verified across the changed scope (apps/server/src/auth/*, apps/server/src/cloud/*, apps/desktopop/src.ts):

• Imports: Effect modules are imported as subpath namespaces; local service modules (ServerConfig, ServerSecretStore, SessionStore, PairingGrantStore, EnvironmentAuthPolicy) are now namespace-imported with X.X tag access. No consolidated from "effect" imports were introduced. Error-only imports (e.g. in dpop.ts) remain named, which the conventions permit.
• Service definitions: FooShape interfaces were removed and inlined into Context.Service; references use Foo["Service"]. make is a real Effect.gen constructor and layer = Layer.effect(...) is canonical.
• Errors/predicates: Failures are modeled with Schema.TaggedErrorClass, distinct tags split semantically distinct failures, message getters derive from structural attributes (never from cause), real causes are preserved via Schema.Defect(), Schema.Union aggregates are exported, and predicates are direct export const isFoo = Schema.is(Foo). The one multi-value discriminator (SessionClaimsEncodingError.operation) uses the permitted single-error + generic-message pattern. Caller-visible reason strings are preserved via serverAuthCredentialReason/serverAuthInvalidRequestReason.
• File layout: Files stayed in place (in-file refactor), so no compatibility shims were needed; consumers were mechanically updated.

No convention violations were found in the PR's changed scope. Pre-existing *Shape interfaces elsewhere in the repo are outside this PR's scope and not flagged.',