refactor(shared): move upload/ into infrastructure/domain/application (RB-24)

libs/shared/src/upload/ held a network adapter, an Elm machine, and two
application-layer coordinators outside the folder-per-layer convention every
other context follows. The dependency-cruiser rule carved an exception around
the misplaced adapter instead of the violation being fixed.

Move all five files to the layer each belongs to (git mv), update every
import across 24 consumer files, then delete the carve-out clause from
.dependency-cruiser.base.js. No export renamed, no file split, no spec
content changed.

Deleting the carve-out exposed a second, pre-existing rule violation:
ui-not-infrastructure had never fired against upload.adapter.ts because its
old path did not match /infrastructure/. Three UI components injected
UploadAdapter directly for its one-line contentUrl() wrapper. Route each
through the existing pure uploadContentUrl() function via the application
layer (upload-controller's new previewUrlFor, OrgTemplateStore's new
previewUrlFor) instead — the same idiom brief.store.ts already used.

npm run ci passes; dep:check is clean for both apps with the carve-out gone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/reference/architecture/dependencies.md

@@ -35,7 +35,7 @@ reverse. An app may not import the other app's source directly.
 **Atomic-layer rules:** `domain/` is framework-free (no Angular); `contracts/` import nothing
 (pure wire DTOs, ADR-0001); `ui/` + `layout/` never import `infrastructure/` directly (reach data
 through an application store/command — type-only DTO imports are fine); the generated `ApiClient`
-is a value only inside `infrastructure/` (+ `libs/shared/src/upload`). Plus **no circular**
+is a value only inside `infrastructure/`. Plus **no circular**
 dependencies. These apply uniformly across an app's tree and both libraries — no debug-state
 exception anymore (WP-67 moved the dev panel component out of `libs/shared` into `apps/ssp` since
 it's genuinely SSP-specific, coupled to `BigProfileStore`; the shared `ShellComponent` hosts