Extract handleAuthEndpoint, routeOrError, writeModelValidationError, authenticateV1, enforceBodyLimit, setupCAGProxy. No behavior change. All tests pass with -race.