refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

Create 6 domain-focused config files in src/config/ to centralize operational
tuning knobs that were scattered across 15+ source files:

- server-timing.ts: SSE batching, state debounce, scheduled runs, error recovery
- auth-config.ts: session TTL, rate limits, hook timeout
- tunnel-config.ts: QR token rotation, tunnel process lifecycle
- terminal-limits.ts: input length, terminal cols/rows, session name
- ai-defaults.ts: AI model string, idle/plan context limits
- team-config.ts: poll interval, cache sizes

Eliminates all cross-file duplicates:
- AI model string: 5 occurrences → 1 (config only)
- STATS_COLLECTION_INTERVAL_MS: 2 → 1
- timeout: 10000 in hooks-config: 6 → 0 (now HOOK_TIMEOUT_MS)
- MAX_TRACKED_AGENTS shadow: removed, imports from map-limits

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/middleware/auth.ts

@@ -12,17 +12,15 @@ import { FastifyInstance } from 'fastify';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { StaleExpirationMap } from '../../utils/index.js';
 import type { AuthSessionRecord } from '../ports/auth-port.js';
+import {
+  AUTH_SESSION_TTL_MS,
+  MAX_AUTH_SESSIONS,
+  AUTH_FAILURE_MAX,
+  AUTH_FAILURE_WINDOW_MS,
+} from '../../config/auth-config.js';
 
-// Auth session cookie TTL (24h — matches autonomous run length)
-const AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 // Auth session cookie name
 export const AUTH_COOKIE_NAME = 'codeman_session';
-// Max concurrent auth sessions
-const MAX_AUTH_SESSIONS = 100;
-// Max failed auth attempts per IP before rate-limiting
-const AUTH_FAILURE_MAX = 10;
-// Failed auth attempt tracking window (15 minutes)
-const AUTH_FAILURE_WINDOW_MS = 15 * 60 * 1000;
 
 /** State returned from registerAuthMiddleware for cleanup in server stop() */
 export interface AuthState {