Follow-ups from #940 review: split group_ceiling.go, deny malformed requested amount under a cap #953

#940 (issue #83) merged at 7dc1891. Its independent review left these non-blocking notes:

1. internal/auth/group_ceiling.go is 519 lines, over the 500-line guideline.
2. matchPurchaseAmountConstraint does not reject a negative, NaN or ±Inf requested amount (reqMax). The cap itself is already validated. Today reqMax is computed server-side, so this is defense in depth.
3. An operator note for stored negative caps on carved-out money verbs. This is already recorded in fix(auth): fail closed on a negative MaxPurchaseAmount spend cap #940's description under "Behavior notes", since docs/DEPLOYMENT.md is over the length guideline.

1 and 2 were written as commits on the #940 branch, but #940 merged just before they were pushed. A follow-up PR carries them.

🤖 Generated with Claude Code