feat(core)!: introduce runtime extension registry and flat module conventions

BREAKING CHANGE: sup config now derives entries from package.json#exports and a server/client glob instead of manual lists; module structure follows flat + barrel convention with .server.js/.client.js runtime suffixes

src/features/auth/auth.js

@@ -5,16 +5,16 @@ import {
   requestPasswordReset,
   verifyUserEmail,
   updateUser
-} from '../../../core/users/auth.js';
+} from '../../core/users/auth.js';
 import { sendPasswordChangedEmail } from './email.js';
 
-// Inject email sending into register (verification email) — kept here because
-// it depends on JSX templates that live in features/auth.
+// Inject sendPasswordChangedEmail — the JSX template lives in features/auth so
+// the auth feature stays self-contained and core/users can remain pure server
+// logic without JSX.
 export function register(userData) {
   return _register(userData);
 }
 
-// Inject sendPasswordChangedEmail — the template lives in features/auth.
 export function resetPassword(resetData) {
   return _resetPassword(resetData, { onPasswordChanged: sendPasswordChangedEmail });
 }