build: tighten domain module interfaces after the split #288

Parent: #52 · Follow-up to #286

Splitting the code into modules made 178 internal declarations public, because the app or its tests use them. About 40 of them are used only by app tests. This issue tightens each domain's interface back to what the UI actually needs. An architecture audit of the module split surfaced the items below.

Interface

• State constructors and nextRequestValue are public on eight domain states, so any caller can mint colliding request ids. Only one UI call site builds a state by hand: SearchState in MobileShell.kt. App tests build the rest: 42 files, 82 of them through FilesBrowserReducer.reduce(. Add SearchReducer.start(), move the state builders into each owner's src/testFixtures, and make the constructors internal again. Done in build: hide domain state constructors and test-only internals #299.
• Keystore record internals (ENCRYPTED_ACCESS_TOKEN_KEY, AuthTokenCipher, authTokenKeyAlias) and transfers operations (TransfersReadOperations, TransfersAddOperations) are public only for app tests: MobileAuthStorageRecoveryTest, KeystoreAuthTokenStoreInstrumentedTest, TransfersPollingCpuBenchmark, MobileTransferRetryProofTest. Move those tests into domain/auth and domain/transfers, then hide the internals again. Done in build: hide domain state constructors and test-only internals #299; MobileAuthStorageRecoveryTest and MobileTransferRetryProofTest stay in mobile because they drive app UI, now through fixtures.
• Turn on Kotlin explicit API mode in the library convention plugin once the interfaces are tight, so future promotions are deliberate.

Shared kernel

• files doubles as the shared kernel: FilesFailure, FilesRepositoryResult, FilesItemId, FilesCursor and toFilesFailure. account and playback clone the same failure, result and apiReason taxonomy four times. Extract a put.io failure and result kernel so a Files change stops rebuilding five modules. Done in build: move the put.io failure and result kernel into core/common #303: the kernel is PutioFailure/PutioResult in core/common; account, playback and transfers no longer depend on files.

Placement

• domain/downloads has one adapter per interface, both mobile-only, and TV never imports it. Either fold it into the mobile app or keep it once TV downloads are on the roadmap. Folded into mobile in build: fold downloads into mobile and move the account notice words to core/design #298.
• domain/account ships a composable and strings (InactiveAccountNotice), and core/design holds BasePutioActivity. Move each to where it is used. build: fold downloads into mobile and move the account notice words to core/design #298 moved the words to core/design; BasePutioActivity stays there, since both apps extend it and it applies core/design's theme.

Acceptance

• ./gradlew verify stays green. The number of public declarations in core and domain goes down, and no app test depends on a domain's internals.

Written by an agent (Claude Code, Opus 5.5)