chore(psr4): phase 3 (Core hubs) — namespace Core/Auth

Move Core/Auth into XcVm\Core\Auth (Authenticator, Authorization, AuthRepository,
AuthService, BruteforceGuard, PageAuthorization, SessionManager).

- Namespace the 7 classes; same-namespace siblings unqualified; migrated deps
  (Logger, ApiClient, QueryHelper, SettingsManager, RequestManager) keep their
  existing use imports. Qualify still-global deps with leading backslash
  (\UserRepository, \NetworkUtils, \ServerRepository, \BlocklistService,
  \DatabaseFactory, \RedisManager, \AdminHelpers, \Encryption, \CodeService,
  \CodeRepository) — these migrate later with Domain/Util.
- Add 'use XcVm\Core\Auth\...;' to referencing files (Authorization 69,
  AuthRepository 24, BruteforceGuard 12, SessionManager/PageAuthorization 9,
  Authenticator 5, AuthService 3) across src/ and tests/.
- Fix pre-existing leading-backslash refs (e.g. Router's \Authorization, now
  \XcVm\Core\Auth\Authorization). Preserve class_exists('NetworkUtils',false)
  defensive string guards as-is (still-global classes).
- phpstan-baseline.neon regenerated (292→292; AuthRepository::getHMACById message
  re-anchored with namespace, no new/unknown-class errors).

Verified: php -l clean; PHPStan no errors; PHPUnit 295/295; Auth classes resolve
via Composer; leading-backslash re-sweep clean.

src/Domain/User/UserRepository.php

@@ -1,5 +1,6 @@
 <?php
 
+use XcVm\Core\Auth\Authenticator;
 use XcVm\Core\Database\Database;
 use XcVm\Core\Database\DatabaseHandler;
 /**