refactor: deepen Google sync domain modules

[Uarmagan]

Summary

This PR implements #1719 by making the Google sync backend easier to navigate by domain responsibility instead of by the overloaded term sync.

The main change is structural: the existing behavior is preserved, but the modules now describe the product flow they own:

• Compass-to-Google event propagation
• Google-to-Compass event propagation
• Google Import
• Google Watch
• Public watch notifications
• Google sync orchestration and health
• Sync records repository
• Google-specific test drivers

Why

The old layout made several different concepts look similar:

• sync could mean import, watch lifecycle, notification handling, sync records, event propagation, or user sync health.
• Google webhook validation lived in auth middleware even though it belonged to the public watch notification boundary.
• User metadata computed Google sync health directly, which mixed user-facing status with watch/sync-record diagnosis.
• Test helpers used generic sync and watch names, even when they were setting up Google-specific scenarios.
• Some files used mixed naming patterns such as google-sync-health.ts, sync.import.ts, and sync.records.ts.

That made the code harder to read and harder to safely change.

What Changed

Event propagation is named by direction

Moved the old direction-specific processors into an explicit event propagation area:

• compass-to-google.event-propagation.ts
• google-to-compass.event-propagation.ts
• compass-to-google-backfill.ts

This makes the two main event flows easier to distinguish:

• Compass event changed -> mirror to Google
• Google event changed -> apply to Compass

Google Import has domain-first names

Renamed the import module family from the old sync.import.* pattern to:

• google-import.service.ts
• google-import.types.ts
• google-import.util.ts

This makes Import read as its own Google sync lane instead of another generic sync helper.

Google Watch owns watch-specific helpers

Split generic sync/watch utilities into Google Watch modules:

• google-watch-token.ts
• google-watch-timing.ts
• google-watch-state.ts
• google-watch-config.ts
• google-watch-activity.ts

This keeps watch expiration, token decoding, HTTPS capability, active-watch state, and recent Compass activity checks near Google Watch behavior.

Public watch notifications have one ingress module

Added:

• public-watch-notification.ingress.ts

This module now owns public Google callback validation and parsing before the controller hands work to Google Watch. That removes Google webhook verification from generic auth middleware and keeps browser/API traffic separate from public Google webhook traffic.

Google sync orchestration uses shorter plumbing names

Renamed the orchestration and plumbing module family to:

• google-sync.service.ts
• google-sync.health.ts
• google-sync.errors.ts
• gcal.client.ts

This keeps app-level sync behavior under google-sync and reserves gcal for the raw Google Calendar client plumbing.

Google sync health moved out of user metadata

Added:

• google-sync.health.ts

User metadata now asks this module whether Google sync is healthy instead of directly inspecting sync/watch state. That keeps metadata focused on user-facing state and keeps sync diagnosis in the Google sync domain.

Sync records are behind a repository module

Moved sync record lookup/update/delete behavior into:

• sync-records.repository.ts

This replaces the generic query/helper split and makes the storage owner explicit.

Shared utility moved out of sync

Moved the concurrency limiter into common utilities:

• common/util/concurrency-limiter.util.ts

The old generic sync utility file is removed.

Test support now uses Google sync language

Renamed/deepened test helpers:

• google-sync.driver.ts
• google-watch.driver.ts

Controller helpers remain focused on request/transport setup, while Google sync drivers describe Google-specific scenarios.

Docs updated

Updated the active docs and file maps so future work starts in the right place, including:

• CONTEXT.md
• docs/features/google-sync-and-sse-flow.md
• docs/development/feature-file-map.md
• backend and development docs that referenced moved modules

Naming Convention Used

This PR standardizes on domain-first filenames for the Google sync area:

• google-import.* for Google Import
• google-watch-* for Google Watch behavior
• google-sync.* for Google sync orchestration, health, and errors
• gcal.client.ts for raw Google Calendar API client setup
• public-watch-notification.* for the public webhook boundary
• sync-records.repository.ts for sync record persistence
• compass-to-google.* and google-to-compass.* for event propagation direction

The remaining frontend state names such as sync.importGCal were intentionally left alone because they are state shape names, not backend module names.

Verification

Ran and passed:

• bun run type-check
• bun run lint
• focused backend tests for the renamed Google sync files:
  • gcal.client.test.ts
  • google-sync.health.test.ts
  • google-sync.service.test.ts
• stale-name scans for old backend module paths
• git diff --check

Notes:

• bun run lint still prints the existing repo-wide warning backlog, but exits successfully.
• The full backend test runner currently reaches an unrelated user.controller 404 failure; the rename-affected backend tests pass.