refactor(arch): move Access into Modules/Access

docs/runbooks/simulation-fixture-on-a-dev-database.md

@@ -212,7 +212,7 @@ A does not exist for form B, and vice versa.
 ### 4. The knobs
 
 All bind from the `Simulation` section
-([`SimulationOptions.cs`](../../src/Cluckwork.Infrastructure/Identity/SimulationOptions.cs));
+([`SimulationOptions.cs`](../../src/Cluckwork.Infrastructure/Persistence/SimulationOptions.cs));
 as environment variables the separator is `__`.
 
 | Key | Default | What it does |

docs/superpowers/plans/2026-08-02-credential-epoch.md

@@ -24,9 +24,9 @@
 ### Task 1: Storage, migration, and token issuance
 
 **Files:**
-- Modify: `src/Cluckwork.Infrastructure/Identity/ApplicationUser.cs`
-- Modify: `src/Cluckwork.Infrastructure/Identity/RefreshToken.cs`
-- Modify: `src/Cluckwork.Infrastructure/Identity/JwtTokenService.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/ApplicationUser.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/RefreshToken.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/JwtTokenService.cs`
 - Modify: `src/Cluckwork.Infrastructure/Persistence/Configurations/ApplicationUserConfiguration.cs`
 - Modify: `src/Cluckwork.Infrastructure/Persistence/Migrations/20260801190854_InitialCreate.cs`
 - Modify: `src/Cluckwork.Infrastructure/Persistence/Migrations/AppDbContextModelSnapshot.cs`
@@ -45,8 +45,8 @@
 **Files:**
 - Create: `src/Cluckwork.Api/Middleware/CredentialEpochMiddleware.cs`
 - Modify: `src/Cluckwork.Api/Program.cs`
-- Modify: `src/Cluckwork.Infrastructure/Identity/IdentityProvider.cs`
-- Modify: `src/Cluckwork.Infrastructure/Identity/StepUpGrantService.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/IdentityProvider.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/StepUpGrantService.cs`
 - Test: `tests/Cluckwork.Api.IntegrationTests/CredentialEpochTests.cs`
 
 **Interfaces:**

docs/superpowers/plans/2026-08-25-change-user-email.md

@@ -50,9 +50,9 @@ Run:
 
 ```bash
 git ls-files \
-  src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailCommand.cs \
-  src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailValidator.cs \
-  src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailHandler.cs \
+  src/Cluckwork.Application/Modules/Access/Contracts/ChangeUserEmailCommand.cs \
+  src/Cluckwork.Application/Modules/Access/Users/ChangeUserEmail/ChangeUserEmailValidator.cs \
+  src/Cluckwork.Application/Modules/Access/Users/ChangeUserEmail/ChangeUserEmailHandler.cs \
   tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailTests.cs \
   tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailRaceTests.cs
 ```
@@ -86,15 +86,15 @@ Expected: branch is `feat/change-user-email`, based on the recorded baseline SHA
 
 **Files:**
 
-- Create: `src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailCommand.cs`
-- Create: `src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailValidator.cs`
-- Create: `src/Cluckwork.Application/Features/Users/ChangeUserEmail/ChangeUserEmailHandler.cs`
+- Create: `src/Cluckwork.Application/Modules/Access/Contracts/ChangeUserEmailCommand.cs`
+- Create: `src/Cluckwork.Application/Modules/Access/Users/ChangeUserEmail/ChangeUserEmailValidator.cs`
+- Create: `src/Cluckwork.Application/Modules/Access/Users/ChangeUserEmail/ChangeUserEmailHandler.cs`
 - Create: `tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailTests.cs`
 - Create: `tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailRaceTests.cs`
-- Modify: `src/Cluckwork.Application/Common/IIdentityProvider.cs`
+- Modify: `src/Cluckwork.Application/Modules/Access/Users/IIdentityProvider.cs`
 - Modify: `src/Cluckwork.Application/Common/AuditActions.cs`
-- Modify: `src/Cluckwork.Infrastructure/Identity/IdentityProvider.cs`
-- Modify: `src/Cluckwork.Api/Endpoints/Users/UserEndpoints.cs`
+- Modify: `src/Cluckwork.Infrastructure/Modules/Access/Identity/IdentityProvider.cs`
+- Modify: `src/Cluckwork.Api/Modules/Access/Users/UserEndpoints.cs`
 - Modify: `src/Cluckwork.Api/Hosting/CluckworkFeatureServiceCollectionExtensions.cs`
 - Modify: `tests/Cluckwork.Application.Tests/TenantBypass/Data/filter-free-set-sites.tsv`
 - Modify: `web/src/i18n/enums.ts`
@@ -294,8 +294,8 @@ Expected: focused tests pass; build ends `0 Warning(s) 0 Error(s)`.
 - [ ] **Step 9: Commit the backend vertical slice.**
 
 ```bash
-git add src/Cluckwork.Application src/Cluckwork.Infrastructure/Identity/IdentityProvider.cs \
-  src/Cluckwork.Api/Endpoints/Users/UserEndpoints.cs \
+git add src/Cluckwork.Application src/Cluckwork.Infrastructure/Modules/Access/Identity/IdentityProvider.cs \
+  src/Cluckwork.Api/Modules/Access/Users/UserEndpoints.cs \
   src/Cluckwork.Api/Hosting/CluckworkFeatureServiceCollectionExtensions.cs \
   tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailTests.cs \
   tests/Cluckwork.Api.IntegrationTests/ChangeUserEmailRaceTests.cs \

specs/001-searchable-entity-picker/tasks.md

@@ -147,7 +147,7 @@
 - [X] T044 [US4] Implement scoped bulk flock-reference reads and restrict movement aggregation to returned flock IDs in `src/Cluckwork.Application/Modules/FlockManagement/Flocks/IFlockRepository.cs`, `src/Cluckwork.Application/Modules/FlockManagement/Flocks/IBirdMovementRepository.cs`, `src/Cluckwork.Infrastructure/Repositories/FlockRepository.cs`, `src/Cluckwork.Infrastructure/Repositories/BirdMovementRepository.cs`, and `src/Cluckwork.Api/Modules/FlockManagement/Flocks/FlockEndpoints.cs`.
 - [X] T045 [P] [US4] Add `flockName`/`flockStatus` to Daily Entry list/detail projection through one scoped bulk read in `src/Cluckwork.Api/Modules/EggOperations/DailyEntries/DailyEntryEndpoints.cs` and `src/Cluckwork.Infrastructure/Repositories/DailyEntryRepository.cs`.
 - [X] T046 [P] [US4] Add row-owned `flockName` to Feed and Water list projections in `src/Cluckwork.Api/Modules/GeneralInventory/Inventory/InventoryEndpoints.cs`, `src/Cluckwork.Api/Modules/GeneralInventory/Water/WaterUsageEndpoints.cs`, `src/Cluckwork.Infrastructure/Repositories/FeedUsageRepository.cs`, and `src/Cluckwork.Infrastructure/Repositories/WaterUsageRepository.cs`.
-- [X] T047 [P] [US4] Return nullable assignment `flockName` from one scoped left join while keeping the list unpaged in `src/Cluckwork.Application/Features/Users/IUserRoleAssignmentRepository.cs`, `src/Cluckwork.Infrastructure/Repositories/UserRoleAssignmentRepository.cs`, and `src/Cluckwork.Api/Endpoints/Users/UserEndpoints.cs`.
+- [X] T047 [P] [US4] Return nullable assignment `flockName` from one scoped left join while keeping the list unpaged in `src/Cluckwork.Application/Modules/Access/Users/IUserRoleAssignmentRepository.cs`, `src/Cluckwork.Infrastructure/Repositories/UserRoleAssignmentRepository.cs`, and `src/Cluckwork.Api/Modules/Access/Users/UserEndpoints.cs`.
 - [X] T048 [P] [US4] Implement scoped bulk customer references and add `customerName` to Sales list/detail responses in `src/Cluckwork.Application/Modules/Commerce/Customers/ICustomerRepository.cs`, `src/Cluckwork.Infrastructure/Repositories/CustomerRepository.cs`, and `src/Cluckwork.Api/Modules/Commerce/Sales/SaleEndpoints.cs`.
 - [X] T049 [P] [US4] Add nullable `flockName` to Expense list/detail/adjust responses through scoped grouped reads in `src/Cluckwork.Application/Modules/Finance/Expenses/IExpenseRepositories.cs`, `src/Cluckwork.Infrastructure/Repositories/ExpenseRepositories.cs`, and `src/Cluckwork.Api/Modules/Finance/Expenses/ExpenseEndpoints.cs`.
 - [X] T050 [US4] Add all six required/nullable row-owned response fields to the frontend types and remove every ID-fragment reference fallback in `web/src/api/cluckwork.ts`.

src/Cluckwork.Api/Cli/BootstrapAdminCliCommand.cs

@@ -1,4 +1,4 @@
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Infrastructure.Persistence;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.EntityFrameworkCore;

src/Cluckwork.Api/Cli/ProvisionAccountCliCommand.cs

@@ -1,4 +1,4 @@
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Domain.Accounts;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;

src/Cluckwork.Api/Cli/ReactivateAccountCliCommand.cs

@@ -1,5 +1,5 @@
 using Cluckwork.Application.Features.Accounts;
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
 

src/Cluckwork.Api/Cli/RecoverAdminCliCommand.cs

@@ -1,4 +1,4 @@
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
 

src/Cluckwork.Api/Cli/RenameAccountCliCommand.cs

@@ -1,5 +1,5 @@
 using Cluckwork.Application.Features.Accounts;
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Domain.Accounts;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;

src/Cluckwork.Api/Cli/SuspendAccountCliCommand.cs

@@ -1,5 +1,5 @@
 using Cluckwork.Application.Features.Accounts;
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
 

src/Cluckwork.Api/Hosting/CluckworkIdentityServiceCollectionExtensions.cs

@@ -1,13 +1,14 @@
+using Cluckwork.Application.Modules.Access.Contracts;
+using Cluckwork.Application.Modules.Access.Users;
+using Cluckwork.Application.Modules.Access.Users.CreateUser;
+using Cluckwork.Application.Modules.Access.Users.SetLanguage;
+using Cluckwork.Application.Modules.Access.Users.SetStepperUnit;
+using Cluckwork.Infrastructure.Modules.Access.Identity;
 using System.Security.Cryptography;
 using Cluckwork.Api.Configuration;
 using Cluckwork.Api.Middleware;
 using Cluckwork.Api.Security;
 using Cluckwork.Application.Common;
-using Cluckwork.Application.Features.Users;
-using Cluckwork.Application.Features.Users.CreateUser;
-using Cluckwork.Application.Features.Users.SetLanguage;
-using Cluckwork.Application.Features.Users.SetStepperUnit;
-using Cluckwork.Infrastructure.Identity;
 using Cluckwork.Infrastructure.Persistence;
 using Cluckwork.Infrastructure.Repositories;
 using FluentValidation;
@@ -176,48 +177,48 @@ private static void AddUserFeatures(IServiceCollection services)
             UserRoleAssignmentRepository>();
         services.AddScoped<IValidator<CreateUserCommand>, CreateUserValidator>();
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.UpdateUser.UpdateUserCommand>,
-            Cluckwork.Application.Features.Users.UpdateUser.UpdateUserValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.UpdateUserCommand>,
+            Cluckwork.Application.Modules.Access.Users.UpdateUser.UpdateUserValidator>();
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.SetUserPassword.SetUserPasswordCommand>,
-            Cluckwork.Application.Features.Users.SetUserPassword.SetUserPasswordValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.SetUserPasswordCommand>,
+            Cluckwork.Application.Modules.Access.Users.SetUserPassword.SetUserPasswordValidator>();
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.ChangeOwnPassword.ChangeOwnPasswordCommand>,
-            Cluckwork.Application.Features.Users.ChangeOwnPassword.ChangeOwnPasswordValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.ChangeOwnPasswordCommand>,
+            Cluckwork.Application.Modules.Access.Users.ChangeOwnPassword.ChangeOwnPasswordValidator>();
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.ChangeUserRole.ChangeUserRoleCommand>,
-            Cluckwork.Application.Features.Users.ChangeUserRole.ChangeUserRoleValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.ChangeUserRoleCommand>,
+            Cluckwork.Application.Modules.Access.Users.ChangeUserRole.ChangeUserRoleValidator>();
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.ChangeUserEmail.ChangeUserEmailCommand>,
-            Cluckwork.Application.Features.Users.ChangeUserEmail.ChangeUserEmailValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.ChangeUserEmailCommand>,
+            Cluckwork.Application.Modules.Access.Users.ChangeUserEmail.ChangeUserEmailValidator>();
         // #356 — disable carries an optional reason; enable carries no body at
         // all and therefore has no validator.
         services.AddScoped<
-            IValidator<Cluckwork.Application.Features.Users.DisableUser.DisableUserCommand>,
-            Cluckwork.Application.Features.Users.DisableUser.DisableUserValidator>();
+            IValidator<Cluckwork.Application.Modules.Access.Contracts.DisableUserCommand>,
+            Cluckwork.Application.Modules.Access.Users.DisableUser.DisableUserValidator>();
         services.AddScoped<IValidator<SetLanguageCommand>, SetLanguageValidator>();
         services.AddScoped<IValidator<SetStepperUnitCommand>, SetStepperUnitValidator>();
         services.AddScoped<CreateUserHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.UpdateUser.UpdateUserHandler>();
+            Cluckwork.Application.Modules.Access.Users.UpdateUser.UpdateUserHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.SetUserPassword.SetUserPasswordHandler>();
+            Cluckwork.Application.Modules.Access.Users.SetUserPassword.SetUserPasswordHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.ChangeOwnPassword.ChangeOwnPasswordHandler>();
+            Cluckwork.Application.Modules.Access.Users.ChangeOwnPassword.ChangeOwnPasswordHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.ChangeUserRole.ChangeUserRoleHandler>();
+            Cluckwork.Application.Modules.Access.Users.ChangeUserRole.ChangeUserRoleHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.ChangeUserEmail.ChangeUserEmailHandler>();
+            Cluckwork.Application.Modules.Access.Users.ChangeUserEmail.ChangeUserEmailHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.DisableUser.DisableUserHandler>();
+            Cluckwork.Application.Modules.Access.Users.DisableUser.DisableUserHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.EnableUser.EnableUserHandler>();
+            Cluckwork.Application.Modules.Access.Users.EnableUser.EnableUserHandler>();
         services.AddScoped<SetLanguageHandler>();
         services.AddScoped<SetStepperUnitHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.AssignFlock.AssignFlockHandler>();
+            Cluckwork.Application.Modules.Access.Users.AssignFlock.AssignFlockHandler>();
         services.AddScoped<
-            Cluckwork.Application.Features.Users.AssignFlock.UnassignFlockHandler>();
+            Cluckwork.Application.Modules.Access.Users.AssignFlock.UnassignFlockHandler>();
     }
 
     // Serving-only (#347). A one-shot verb neither issues nor validates a token,

src/Cluckwork.Api/Hosting/CluckworkPersistenceServiceCollectionExtensions.cs

@@ -1,13 +1,13 @@
 using Cluckwork.Application.Common;
 using Cluckwork.Application.Features.Accounts;
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Application.Modules.Commerce.Contracts;
 using Cluckwork.Application.Modules.EggOperations.Contracts;
 using Cluckwork.Application.Modules.Finance.Contracts;
 using Cluckwork.Application.Modules.FlockManagement.Contracts;
 using Cluckwork.Application.Modules.GeneralInventory.Contracts;
-using Cluckwork.Infrastructure.Identity;
 using Cluckwork.Infrastructure.Jobs;
+using Cluckwork.Infrastructure.Modules.Access.Identity;
 using Cluckwork.Infrastructure.Persistence;
 using Cluckwork.Infrastructure.Persistence.Interceptors;
 using Cluckwork.Infrastructure.Providers;

src/Cluckwork.Api/Hosting/Modules/CluckworkPlatformServiceCollectionExtensions.cs

@@ -22,12 +22,12 @@ public static IServiceCollection AddCluckworkPlatformServices(
         // #309 — the login DTO validator lives in the Api assembly (it validates
         // the Api LoginRequest). MAX-length only; see LoginRequestValidator.
         services.AddScoped<
-            IValidator<Cluckwork.Api.Endpoints.Auth.LoginRequest>,
-            Cluckwork.Api.Endpoints.Auth.LoginRequestValidator>();
+            IValidator<Cluckwork.Api.Modules.Access.Auth.LoginRequest>,
+            Cluckwork.Api.Modules.Access.Auth.LoginRequestValidator>();
         // #308
         services.AddScoped<
-            IValidator<Cluckwork.Api.Endpoints.Auth.StepUpRequest>,
-            Cluckwork.Api.Endpoints.Auth.StepUpRequestValidator>();
+            IValidator<Cluckwork.Api.Modules.Access.Auth.StepUpRequest>,
+            Cluckwork.Api.Modules.Access.Auth.StepUpRequestValidator>();
 
         // #307 — lease duration / max-wait bounds for the idempotency claim protocol.
         services.Configure<IdempotencyOptions>(

src/Cluckwork.Api/Middleware/CredentialEpochMiddleware.cs

@@ -1,6 +1,6 @@
+using Cluckwork.Application.Modules.Access.Contracts;
 using System.Globalization;
 using System.IdentityModel.Tokens.Jwt;
-using Cluckwork.Application.Features.Users;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.AspNetCore.Mvc;
 

src/Cluckwork.Api/Middleware/FlockScopeResolutionMiddleware.cs

@@ -1,5 +1,4 @@
-using Cluckwork.Application.Features.Users;
-using Cluckwork.Infrastructure.Identity;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Infrastructure.Persistence;
 using Microsoft.AspNetCore.Diagnostics;
 

src/Cluckwork.Api/Middleware/IdempotencyMiddleware.cs

@@ -1,6 +1,5 @@
 using System.Security.Cryptography;
 using System.Text;
-using Cluckwork.Infrastructure.Identity;
 using Cluckwork.Infrastructure.Persistence;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.EntityFrameworkCore;

src/Cluckwork.Api/Middleware/TenantResolutionMiddleware.cs

@@ -1,4 +1,3 @@
-using Cluckwork.Infrastructure.Identity;
 using Cluckwork.Infrastructure.Persistence;
 
 namespace Cluckwork.Api.Middleware;

src/Cluckwork.Api/Endpoints/Auth/AuthCookies.cs → src/Cluckwork.Api/Modules/Access/Auth/AuthCookies.cs

@@ -1,4 +1,4 @@
-namespace Cluckwork.Api.Endpoints.Auth;
+namespace Cluckwork.Api.Modules.Access.Auth;
 
 // #145 — the refresh token lives only in an HttpOnly cookie, never in a response
 // body or JS-readable storage; the access token stays a Bearer header held in

src/Cluckwork.Api/Endpoints/Auth/AuthEndpoints.cs → src/Cluckwork.Api/Modules/Access/Auth/AuthEndpoints.cs

@@ -3,13 +3,12 @@
 using Cluckwork.Api.RateLimiting;
 using Cluckwork.Api.Validation;
 using Cluckwork.Application.Common;
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Domain.Accounts;
-using Cluckwork.Application.Features.Users.ChangeOwnPassword;
 using Cluckwork.Infrastructure.Persistence;
 using FluentValidation;
 
-namespace Cluckwork.Api.Endpoints.Auth;
+namespace Cluckwork.Api.Modules.Access.Auth;
 
 public static class AuthEndpoints
 {

src/Cluckwork.Api/Endpoints/Auth/LoginRequestValidator.cs → src/Cluckwork.Api/Modules/Access/Auth/LoginRequestValidator.cs

@@ -1,8 +1,8 @@
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Users;
 using Cluckwork.Domain.Accounts;
 using FluentValidation;
 
-namespace Cluckwork.Api.Endpoints.Auth;
+namespace Cluckwork.Api.Modules.Access.Auth;
 
 // #309 — MAX-length-only guard on the login credentials, plus a not-null guard
 // (see below). Deliberately NO NotEmpty / MinLength: an empty ("") or short

src/Cluckwork.Api/Endpoints/Auth/StepUpRequestValidator.cs → src/Cluckwork.Api/Modules/Access/Auth/StepUpRequestValidator.cs

@@ -1,7 +1,7 @@
-using Cluckwork.Application.Features.Users;
+using Cluckwork.Application.Modules.Access.Users;
 using FluentValidation;
 
-namespace Cluckwork.Api.Endpoints.Auth;
+namespace Cluckwork.Api.Modules.Access.Auth;
 
 // #308 — MAX-length-only, matching LoginRequestValidator's rationale: an
 // empty/short password must still flow to IStepUpGrantService.IssueAsync and

src/Cluckwork.Api/Endpoints/Me/MeEndpoints.cs → src/Cluckwork.Api/Modules/Access/Me/MeEndpoints.cs

@@ -1,13 +1,11 @@
 using Cluckwork.Api.Validation;
 using Cluckwork.Application.Common;
-using Cluckwork.Application.Features.Users;
-using Cluckwork.Application.Features.Users.SetLanguage;
-using Cluckwork.Application.Features.Users.SetStepperUnit;
+using Cluckwork.Application.Modules.Access.Contracts;
 using Cluckwork.Domain.Common;
 using Cluckwork.Infrastructure.Persistence;
 using FluentValidation;
 
-namespace Cluckwork.Api.Endpoints.Me;
+namespace Cluckwork.Api.Modules.Access.Me;
 
 // #45 — the user-scoped counterpart to the farm-scoped /account group. Identity
 // comes from the JWT (sub), not the body. Mounted on the DEFAULT auth policy so