Extract SessionManager interface to fix DIP violation

- Introduce auth.SessionManager interface in internal/auth/interfaces.go
- Rename concrete struct to sessionManager (unexported) and have it satisfy interface
- Update api/service layers to depend on interface, not concrete type
- Add MockSessionManager for testing
- Update all call sites and tests to use interface

1 files changed, 2 insertions, 2 deletions

diff --git a/internal/service/auth.go b/internal/service/auth.go
index af3543d..b5f2720 100644
--- a/internal/service/auth.go
+++ b/internal/service/auth.go
@@ -15,11 +15,11 @@ type authService struct {
 	store  repository.AuthServiceStore
 	clock  clock.Clock
 	hasher auth.Hasher
-	sm     *auth.SessionManager
+	sm     auth.SessionManager
 }
 
 // NewAuthService creates a concrete AuthService.
-func NewAuthService(store repository.AuthServiceStore, clk clock.Clock, hasher auth.Hasher, sm *auth.SessionManager) AuthService {
+func NewAuthService(store repository.AuthServiceStore, clk clock.Clock, hasher auth.Hasher, sm auth.SessionManager) AuthService {
 	return &authService{
 		store:  store,
 		clock:  clk,