refactor(backend): enforce route→service→repo layered architecture

- introduce custom repository exception hierarchy (DuplicateEntryError,
  IntegrityConstraintError, InvalidInputError) replacing raw ValueError
- eliminate all direct repository imports and raw SQL from route layer
- add UserService, SessionService, OrganizationService to service layer
- add get_stats/get_org_distribution service methods replacing admin inline SQL
- fix timing side-channel in authenticate_user via dummy bcrypt check
- replace SHA-256 client secret fallback with explicit InvalidClientError
- replace assert with InvalidGrantError in authorization code exchange
- replace N+1 token revocation loops with bulk UPDATE statements
- rename oauth account token fields (drop misleading 'encrypted' suffix)
- add Alembic migration 0003 for token field column rename
- add 45 new service/repository tests; 975 passing, 94% coverage

backend/tests/services/test_oauth_provider_service.py

@@ -269,18 +269,18 @@ class TestClientValidation:
     async def test_validate_client_legacy_sha256_hash(
         self, db, confidential_client_legacy_hash
     ):
-        """Test validating a client with legacy SHA-256 hash (backward compatibility)."""
+        """Test that legacy SHA-256 hash is rejected with clear error message."""
         client, secret = confidential_client_legacy_hash
-        validated = await service.validate_client(db, client.client_id, secret)
-        assert validated.client_id == client.client_id
+        with pytest.raises(service.InvalidClientError, match="deprecated hash format"):
+            await service.validate_client(db, client.client_id, secret)
 
     @pytest.mark.asyncio
     async def test_validate_client_legacy_sha256_wrong_secret(
         self, db, confidential_client_legacy_hash
     ):
-        """Test legacy SHA-256 client rejects wrong secret."""
+        """Test that legacy SHA-256 client with wrong secret is rejected."""
         client, _ = confidential_client_legacy_hash
-        with pytest.raises(service.InvalidClientError, match="Invalid client secret"):
+        with pytest.raises(service.InvalidClientError, match="deprecated hash format"):
             await service.validate_client(db, client.client_id, "wrong_secret")
 
     def test_validate_redirect_uri_success(self, public_client):