refactor(plugin-auth): move the buildPluginList body into auth-manager-plugin-list.ts

The body of AuthManager.buildPluginList() moves unedited into the module
function buildPluginList, re-indented one level: the reset of the
degraded-feature record and the JWT signing verdict, the enabled table
with its env and config precedence and the SCIM coherence re-check, and
every plugin in the same order (bearer, the organization factory's
arrow, twoFactor, breached-password rejection, admin, phoneNumber,
magicLink, the generic OAuth providers, the OIDC provider with its jwt
plugin, sso, scim, device authorization and the custom session). The
method keeps its place, docblock, signature and return type; it now
builds one host of the 22 AuthManager members the body reads (18
methods as late-bound closures, config and degradedFeatures as getters,
jwtSigningFailureReported and orgRolesMap as get/set pairs because the
body writes them) and returns buildPluginList.call(host). The async
moved from the method to the function.

The organization factory's arrow, which cut 15 left in the body, moves
with it and builds its host from this host, so it reaches the same
members and the same field as before.

readBooleanEnv and consentOrganizationOf, the two top-level declarations
of auth-manager.ts the body reads that the file did not export, are
exported in place and imported by value with the five that already
were; src/index.ts names its auth-manager.ts exports one by one, so
nothing new is published. Nine imported names leave auth-manager.ts
with the body.

Readers that follow it: the two plugin-factory scans read the module,
and the population comments in auth-email-locale.test.ts name it.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -860,7 +860,8 @@ describe("#14641 — an invitation reads the INVITEE's own sys_user.locale", ()
  * implied: the auth mail surface is the five `sendTemplate` call sites in
  * `auth-manager.ts`, `auth-manager-auth-instance.ts` (the body of
  * `createAuthInstance`), `auth-manager-organization-plugin.ts` (the body of
- * the organization plugin's factory) and `auth-manager-email-sms-delivery.ts`
+ * the organization plugin's factory), `auth-manager-plugin-list.ts` (the body
+ * of `buildPluginList`) and `auth-manager-email-sms-delivery.ts`
  * (the body of the change-email notice) — `IEmailService` declares exactly two delivering
  * members (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the
  * SMS service's, and no other file under `plugin-auth/src` calls either.
@@ -1125,8 +1126,9 @@ describe('#15106 — the CLASS claim: all five auth sends read the recipient col
 
   it('every one of the five sends is written in the stored language of its own recipient', async () => {
     // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts`,
-    // `auth-manager-auth-instance.ts`, `auth-manager-organization-plugin.ts` and
-    // `auth-manager-email-sms-delivery.ts` — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
+    // `auth-manager-auth-instance.ts`, `auth-manager-organization-plugin.ts`,
+    // `auth-manager-plugin-list.ts` and `auth-manager-email-sms-delivery.ts` — the
+    // same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
     // plugin-auth's mail surface (see this section's header). This is the pin
     // that closes the class; the per-send pins above only cover one member.
     //