refactor: migrate business logic from cmd/ to pkg/ (DRY architecture)

[CodeMonkeyCybersecurity]

PATTERN COMPLIANCE (P0 - CRITICAL):

• Enforces CLAUDE.md architecture: cmd/ = orchestration, pkg/ = business logic
• Reduces cmd/ file sizes to meet <100 lines guideline
• Follows Assess → Intervene → Evaluate pattern in migrated code
• Uses structured logging (otelzap.Ctx) exclusively

MIGRATIONS COMPLETED:

1. cmd/backup/restore-hecate.go → pkg/backup/restore_hecate.go

   • Migrated: AutoRestore(), InteractiveRestore(), RestoreResource()
   • REDUCTION: 118 lines → 32 lines (73% reduction)
   • PATTERN: All functions follow A→I→E pattern with structured logging
   • cmd/ now contains ONLY Cobra orchestration

2. cmd/update/ldap.go → pkg/ldap/certificate.go

   • Migrated: RegenerateTLSCertificate(), ValidateIPAddress()
   • REDUCTION: 88 lines → 46 lines (48% reduction)
   • SECURITY: Centralized IP validation prevents command injection
   • SECURITY: Added comprehensive threat model documentation
   • cmd/ now delegates to pkg/ldap with config struct

3. cmd/create/hecate_dns.go → pkg/shared/helpers.go

   • Migrated: getEnvOrDefault() → GetEnvOrDefault()
   • BENEFIT: Shared utility now available across entire codebase
   • UPDATED: All 5 usages in hecate_dns.go to use shared function

NEW FILES CREATED:

• pkg/backup/restore_hecate.go (210 lines) - Hecate backup/restore logic
• pkg/ldap/certificate.go (138 lines) - LDAP certificate management

FILES MODIFIED:

• cmd/backup/restore-hecate.go - Now pure orchestration (32 lines)
• cmd/update/ldap.go - Now pure orchestration (46 lines)
• cmd/create/hecate_dns.go - Uses shared.GetEnvOrDefault
• pkg/shared/helpers.go - Added GetEnvOrDefault utility

SECURITY IMPROVEMENTS:

• Centralized IP validation with explicit threat model (ldap/certificate.go:40-47)
• Command injection prevention documented (SECURITY comments)
• CVSS threat scenarios documented in code

BENEFITS:

• Improved testability: Business logic isolated in pkg/ for unit testing
• Better reusability: Functions now available across codebase
• Clearer separation: cmd/ files now <100 lines, easy to understand
• Maintainability: Single responsibility - cmd/ does CLI, pkg/ does work
• Documentation: All pkg/ functions have A→I→E structure documented

RELATED ISSUES: Addresses technical debt from ROADMAP.md
VERIFICATION: gofmt -l passed, all files properly formatted