refactor(app): split monolithic lib.rs/main.rs into per-module files

[tcp404]

Summary

Reorganize `aionui-app` into a layered layout where `lib.rs` / `main.rs` / every `mod.rs` is a pure façade (module declarations + re-exports only). Every type / function lives in its own focused file.

New layout

```
src/
├── main.rs binary entry (47 lines)
├── cli.rs CLI argument definitions
├── lib.rs pure re-exports
├── config.rs AppConfig + derive_encryption_key
├── services.rs AppServices (lib public capability)
├── bootstrap/ binary-private startup helpers
│ ├── mod.rs façade
│ ├── environment.rs ServerEnvironment + init_environment + init_data_layer
│ ├── tracing_init.rs
│ ├── work_dir.rs
│ └── builtin_skills.rs
├── commands/ subcommand implementations
│ ├── mod.rs façade
│ ├── bridge.rs
│ ├── server.rs
│ ├── team_guide.rs
│ └── team_stdio.rs
└── router/ HTTP router assembly
├── mod.rs façade
├── routes.rs create_router* + middleware stack
├── state.rs ModuleStates + build_*_state (merged former module_states.rs + state_builders.rs)
├── trace.rs access log layer
└── health.rs /health + /api/system/guide-mcp
```

Where things live, and why

• `AppServices` in lib tree — tests/* consume `aionui_app::AppServices::from_config` directly, so it must be a public lib capability.
• `bootstrap/` in binary tree — only the binary needs process-level init (`tracing_subscriber::registry().init()`, `std::env::set_var`, builtin-skills materialization). Single consumer (`main`), so it stays binary-private.
• Dependencies flow outer → inner: `main → bootstrap + commands`; `commands::server → bootstrap + aionui_app lib`; `router::routes → router::state → services + config`.

Test plan

• `cargo build -p aionui-app`
• `cargo fmt --all -- --check`
• `cargo clippy -p aionui-app -- -D warnings`
• `cargo test -p aionui-app` — all suites pass (config tests + services tests + state tests + tests/*.rs e2e)