refactor: reorganize internal modules into sub-packages

[Oaklight]

Summary

• Group AES encryption modules (_aes.py, _aes_openssl.py, _crypto.py) into _crypto/ sub-package
• Group CLI utilities (_banner.py, _hook.py, _setup.py) into _cli/ sub-package
• Keep backward-compat shim at _hook.py for deployed codex hook scripts
• Public API unchanged, all 331 tests pass

Closes #9

Test plan

• pytest tests/ — 331 passed
• Public API import verification (from weilink import WeiLink, ILinkError, Message)
• _crypto sub-package works (from weilink._crypto import ...)
• _cli sub-package works (from weilink._cli import ...)
• Backward-compat shim works (from weilink._hook import hook_poll)
• ruff check and ruff format pass

[Oaklight]

Note: This PR includes an unrelated commit (b71d024 — bearer token auth for MCP HTTP transports) that was previously staged but uncommitted in server/app.py. It was included here because cli.py already referenced run_mcp(..., token=token) (added in 56b6353), but the corresponding token parameter and _BearerAuthMiddleware in server/app.py had never been committed — causing the CI typecheck to fail until it was added. Ideally this should have been part of the original CLI integration commit (56b6353).