Shared domain types, traits, static auth checks, config primitives. No dependencies on other workspace crates.