Refactor auth to AuthHex

Distribution/Infra/Authorization/AuthHex/AuthHexClient.cs

@@ -0,0 +1,21 @@
+using System.Net.Http.Json;
+
+namespace Distribution.Infra.Authorization;
+
+/// <summary>
+/// Proxies own-user auth calls (login/register/getUserDetails/logout) to the external AuthHex
+/// identity service. AuthHex owns credentials and issues the RS256-signed JWT this app validates
+/// (see JwtTokenService's replacement — token generation is no longer done locally); this app
+/// never sees or stores a plaintext/hashed password for the AuthHex-authenticated flow.
+/// </summary>
+public class AuthHexClient(HttpClient http) : IAuthHexClient
+{
+    public async Task<AuthHexResponse> CallAsync(string functionName, object? payload, string? reference = null, CancellationToken ct = default)
+    {
+        var body = new { functionName, payload, reference };
+        var response = await http.PostAsJsonAsync("/api/user", body, ct);
+
+        var result = await response.Content.ReadFromJsonAsync<AuthHexResponse>(cancellationToken: ct);
+        return result ?? new AuthHexResponse((int)response.StatusCode, false, "Empty response from AuthHex.", null);
+    }
+}