refactor(indexer,authz): split god-file, dedupe workspace-access checks

[archdex-art]

Scope

Targeted, audit-driven organizational refactor (not a rewrite) — see docs/PROGRESS_TRACKER.md (2026-07-23 entry) for the full audit writeup.

What changed

1. Split lib/indexer.ts (803 lines, 6 mixed concerns) into lib/indexer/:

• constants.ts — scan constants (LANG_BY_EXT, CODE_EXTS, SKIP_DIRS, MAX_FILES)
• util.ts — event-loop yielding helper
• clone.ts — git clone / local-dir resolution / credential redaction
• scan.ts — file walk + import-graph resolution
• analyze.ts — rule-based issue detection, dependency/test hygiene, churn
• score.ts — health-score model
• viz.ts — viz graph / file tree / module graph builders
• index.ts — orchestrator (indexRepo, cleanup) + public re-exports

Matches the directory-import convention already used by lib/agents/, lib/codeintel/, lib/gitops/. Zero callsite changes — all 4 existing importers (store.ts, agents/executor.ts, gitops/historicalAnalysis.ts, api/repos/[id]/git/route.ts) resolve unchanged. Also dropped an unused SymbolGraph type import found in the process.

2. Added authz.requireWorkspace(), deduping the repoAccessDenied() + getWorkspaceDir()-or-404 sequence that was hand-copied across 8 call sites in 4 route files (fs, git, search, timeline) — the same copy-paste-gap class that caused the Phase 0.6 cross-tenant leak documented in the tracker. Also removed fs/route.ts's workspaceOr404, a one-line no-op wrapper around getWorkspaceDir.

Why this scope

Audited the repo against its own established conventions rather than a generic template: no debug leftovers, no genuine circular deps (3 madge flags all resolve to import type-only edges, erased at compile time), no naming-consistency issues. Per the project's own god-file bar (indexer.ts's own rule flags >600 LOC as a maintainability issue), exactly one file crossed it — the one split here. api.ts (473) and settings/page.tsx (582) stayed under that bar and were deliberately left alone.

Verification

• tsc --noEmit — clean
• vitest run — 265/265 passing
• next build — clean
• npm run lint — baseline unchanged (pre-existing findings only, none in touched files)
• Live next dev smoke test: 404 "Repo not found" preserved exactly on all 4 refactored routes for a nonexistent/unowned repo id, then a real end-to-end index of octocat/Hello-World through the split indexer modules (health score computed correctly; fs/git/search all correctly gated through requireWorkspace).

No behavior change intended or observed — pure move + dedup.