chore(auth): swap authtest fence shell script for depguard rule

Why

The shell-script fence in scripts/check-no-authtest-in-prod.sh and its lint:no-authtest-in-prod CI job (landed in !266 (merged)) enforced "no production imports of internal/auth/authtest" by walking go list output. It worked, but lived outside the linter pipeline every Go contributor already reads, duplicated logic that golangci-lint already has, and the surrounding code did not carry the reason the fence existed.

This MR swaps the script for a depguard rule under the existing golangci-lint CI job, with the security rationale named in two places (rule desc: and package godoc) so a future reviewer who sees a non-test import understands the concrete consequence: Fake.Validate uses plain string equality, not crypto/subtle.ConstantTimeCompare; a production import would introduce a timing oracle on token comparison.

What changed

• Enable depguard (was on the disable: list in .golangci.yaml) and add the no-authtest-in-prod rule.
• The rule's files: scope excludes _test.go and the authtest package itself. deny: lists internal/auth/authtest with a desc: naming the timing side-channel.
• Delete scripts/check-no-authtest-in-prod.sh and its dedicated lint:no-authtest-in-prod CI job.
• Rewrite the authtest package godoc to name the timing side-channel as the reason production imports are rejected, and to point at the depguard rule as the enforcement.
• Sync the S08 plan (Step 2 entries, Naming Conventions, Dependencies, Testing Strategy) to the new shape.

Step 5's lint:no-devstubs-in-prod is unchanged. That fence asserts transitive import-graph unreachability, which depguard's per-file deny: cannot express.

Verified

Matrix run on this branch with the rule in place:

Scenario	Result
Clean tree	golangci-lint run exits 0
Non-test file importing authtest	depguard emits ... import '.../authtest' is not allowed from list 'no-authtest-in-prod': <desc> (depguard), exits non-zero
Same file renamed to _test.go	exits 0

Test plan

• CI green on golangci-lint, go test ./internal/auth/..., pre-commit stack.
• git grep -nE 'lint:no-authtest-in-prod|check-no-authtest-in-prod' returns no hits.