refactor: narrow auth service to smaller units

Easier for testing, and omits need for full dep injection for pusher service, where we passed in nil for deps dangerously.

go/cmd/pusherservice/main.go

@@ -36,8 +36,8 @@ func main() {
 	pusherRedis := internal.ConnectAndTestRedis(db.RedisDBPusher)
 
 	// Services
-	authSvc := auth.NewAuthService(authRedis, nil, nil) // nil aeroSvc / fbAuth — pusher only calls GetSession
-	networkReader := network.NewReader(db.Pool())       // pusher only checks membership
+	sessionReader := auth.NewSessionReader(authRedis) // pusher only validates sessions
+	networkReader := network.NewReader(db.Pool())     // pusher only checks membership
 
 	// Pod identity (use hostname in k8s, which is the pod name)
 	podID, err := os.Hostname()
@@ -54,7 +54,7 @@ func main() {
 	authorizer := pusher.NewAuthorizer(networkReader)
 	hub := pusher.NewHub(bridge, authorizer)
 	bridge.SetHub(hub)
-	server := pusher.NewServer(ctx, hub, bridge, authSvc)
+	server := pusher.NewServer(ctx, hub, bridge, sessionReader)
 
 	// Start hub event loop
 	go hub.Run(ctx)