Migrate Auth and Emails to vertical slices (Features.Auth, Features.Emails)

Auth and Emails land together since Auth's registration/resend flows need
Emails to exist first. Service.Auth's four services (Register, Login,
Confirmation, Token) collapse into MediatR commands/queries in
Features.Auth; TokenService stays as a slice-internal service since
multiple handlers call it. Auth no longer references Emails directly —
it sends SendRegistrationEmailCommand/SendResendConfirmationEmailCommand
(defined in Shared.Application) which Features.Emails handles, so neither
slice has a project reference on the other.

Service.Emails' IEmailService becomes Features.Emails' IEmailDispatcher,
simplified to take (firstName, email, token) instead of a full UserAccount
since that's all it ever used. API.Specs' TestApiFactory/MockEmailService
are updated to swap in the relocated interface.

Also deletes Infrastructure.Repository now that Breweries, UserManagement,
and Auth have all moved their repos out of it, and replaces the two
now-dead docker-compose test services (repository.tests, service.auth.tests,
both pointing at deleted Dockerfiles) with a single unit.tests service that
runs every Features.*.Tests project via Dockerfile.tests.

web/backend/Features/Features.Auth/Queries/Login/LoginHandler.cs

@@ -0,0 +1,45 @@
+using Domain.Exceptions;
+using Features.Auth.Dtos;
+using Features.Auth.Repository;
+using Features.Auth.Services;
+using Infrastructure.PasswordHashing;
+using MediatR;
+
+namespace Features.Auth.Queries.Login;
+
+/// <summary>
+/// Handles <see cref="LoginQuery"/> by verifying credentials and issuing access/refresh tokens.
+/// </summary>
+/// <param name="authRepo">Repository used to look up the user account and its active credential.</param>
+/// <param name="passwordInfrastructure">Infrastructure component used to verify a plain-text password against a stored hash.</param>
+/// <param name="tokenService">Service used to generate access and refresh tokens for the authenticated user.</param>
+public class LoginHandler(
+    IAuthRepository authRepo,
+    IPasswordInfrastructure passwordInfrastructure,
+    ITokenService tokenService
+) : IRequestHandler<LoginQuery, LoginPayload>
+{
+    /// <exception cref="UnauthorizedException">
+    /// Thrown when the username does not match any account, the account has no active credential,
+    /// or the supplied password does not match the stored hash.
+    /// </exception>
+    public async Task<LoginPayload> Handle(LoginQuery request, CancellationToken cancellationToken)
+    {
+        var user =
+            await authRepo.GetUserByUsernameAsync(request.Username)
+            ?? throw new UnauthorizedException("Invalid username or password.");
+
+        // @todo handle expired passwords
+        var activeCred =
+            await authRepo.GetActiveCredentialByUserAccountIdAsync(user.UserAccountId)
+            ?? throw new UnauthorizedException("Invalid username or password.");
+
+        if (!passwordInfrastructure.Verify(request.Password, activeCred.Hash))
+            throw new UnauthorizedException("Invalid username or password.");
+
+        var accessToken = tokenService.GenerateAccessToken(user);
+        var refreshToken = tokenService.GenerateRefreshToken(user);
+
+        return new LoginPayload(user.UserAccountId, user.Username, refreshToken, accessToken);
+    }
+}

web/backend/Features/Features.Auth/Queries/Login/LoginQuery.cs

@@ -0,0 +1,10 @@
+using Features.Auth.Dtos;
+using MediatR;
+
+namespace Features.Auth.Queries.Login;
+
+/// <summary>
+/// Authenticates a user using their username and password and issues new tokens. Bound directly
+/// from the request body of <c>POST /api/auth/login</c>.
+/// </summary>
+public record LoginQuery(string Username, string Password) : IRequest<LoginPayload>;

web/backend/Features/Features.Auth/Queries/Login/LoginValidator.cs

@@ -0,0 +1,20 @@
+using FluentValidation;
+
+namespace Features.Auth.Queries.Login;
+
+/// <summary>
+/// Validates <see cref="LoginQuery"/> instances before they are processed.
+/// </summary>
+public class LoginValidator : AbstractValidator<LoginQuery>
+{
+    /// <summary>
+    /// Configures validation rules requiring both <see cref="LoginQuery.Username"/> and
+    /// <see cref="LoginQuery.Password"/> to be non-empty.
+    /// </summary>
+    public LoginValidator()
+    {
+        RuleFor(x => x.Username).NotEmpty().WithMessage("Username is required");
+
+        RuleFor(x => x.Password).NotEmpty().WithMessage("Password is required");
+    }
+}