refactor: split the four most-edited modules into directories

[MotherSphere]

Organizes src/ by splitting the files that actually hurt, chosen from data rather than from size alone.

Why these four

Size is the wrong metric on its own. Measured over six months:

File	Lines	Commits	Action
ui/theme.rs	2935	4	left alone
update.rs	1836	24	split
ui/settings.rs	1707	7	left alone
i18n.rs	1523	12	split
github.rs	1432	15	split
main.rs	606	20	split

ui/theme.rs is the biggest file in the project and the least touched, because it is a palette table read by lookup rather than top to bottom; splitting it would be churn for nothing. main.rs is small but the second most-edited file, because it doubled as crate root and App shell. settings.rs is one long view function that nobody fights with.

What moved

• update.rs → update/ (the one that pays). All 70 match arms lived in one function. mod.rs now holds the dispatch table alone, one line per message, so the whole protocol is visible at a glance, and the bodies sit next to their domain: store.rs (install/update/uninstall/release notes/favorites), github_auth.rs (device flow + catalog fetch), launcher.rs (self-update), preferences.rs (settings + toggles), keyboard.rs (global key handling, 141 lines of it), onboarding.rs (welcome + tutorial). 1836 lines → 820 + six focused files.
• main.rs → main.rs + app.rs. The crate root is now 46 lines: the crate attribute, the module list, main(). boot/view/subscription/theme moved to app.rs and became pub(crate) since main() now calls them across a module boundary.
• i18n.rs → i18n/{mod,fr,en}.rs. Both locale tables shared one file, so adding a string produced a diff straddling two languages ~350 lines apart.
• github.rs → github/{mod,http,types,catalog,releases}.rs, split by layer. mod.rs re-exports everything, so no call site outside the module changed: the rest of the crate still names crate::github::X whatever file X now lives in.

Behaviour is unchanged, and here is why that is checkable

These are pure moves. Two specific hazards, both addressed:

• return inside a moved match arm. An arm body became a method returning Task<Message>, so return X yields the same value from update() as before. Verified across all extracted methods.
• Arm ordering. Every arm matches a distinct variant, so order was never significant. rustc's exhaustiveness check plus a clean clippy --all-targets -D warnings (which would flag an unreachable pattern) prove the table still covers all 70 variants with no redundant arm.

Visibility grew only where the split demands it: github_token and dispatch_next_queued_update to pub(super), and in github/ a few helpers that were private to the old single file (cached_get, GITHUB_API, build_client, the three wire structs) to pub(crate).

Verification

• 119 tests pass, clippy --all-targets -D warnings clean, fmt clean, cross-compiled for Windows with --all-targets.
• Real cargo build of the binary, not just check.
• The i18n key-parity test was confirmed to still guard by breaking parity on purpose and watching fr_and_en_have_identical_key_sets fail, then restoring.

Blame

This is one squashed pure-move commit, so git blame will point here for ~2000 moved lines. A follow-up adds .git-blame-ignore-revs with this commit's SHA (which cannot be known before the squash), so blame keeps pointing at whatever change actually wrote each line.

Left deliberately

ui/theme.rs and ui/settings.rs, per the table above. Grouping the remaining root files (download.rs, scan.rs, persistence.rs, signing.rs, oauth.rs…) into domain directories is possible but is cosmetic churn: they are all under 700 lines and none is a hotspot.