refactor(settings): stage 6.3b promote user runtime types into consumers

First consumer migration pass. Deletes
`lib/crates/fabro-types/src/settings/user.rs` outright:

- `OutputFormat`, `PermissionLevel`: moved into `fabro-agent/src/cli.rs`
  where they are actually consumed as `AgentArgs` fields. They carry
  clap `ValueEnum` derives so `fabro-cli` keeps importing them via the
  `fabro_agent::cli::{OutputFormat, PermissionLevel}` public path.
- `ClientTlsSettings`: moved into `fabro-cli/src/user_config.rs` as a
  crate-private struct. Only `fabro-cli` references it (via
  `cli_target_from_v2` when building the HTTP client).
- `ExecSettings`, legacy `ServerSettings` (from `settings::user`):
  deleted outright — no callers remained.

Also removes the now-dead `From<&GitAuthorSettings> for GitAuthor`
impl in `fabro-checkpoint/src/author.rs`. The v2 `GitAuthorLayer`
conversion is the only path `fabro-workflow::git_author_from_settings`
uses. Drops the `fabro_types::settings::server::GitAuthorSettings`
import along with it.

`settings/mod.rs` drops the `pub mod user` declaration and the
`pub use user::*` re-export line. One of the seven legacy runtime
type modules is now gone; six remain.

3,758 workspace tests pass. `cargo fmt --check --all` and
`cargo clippy --workspace -- -D warnings` are clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/crates/fabro-agent/src/cli.rs

@@ -68,7 +68,26 @@ struct Cli {
     args: AgentArgs,
 }
 
-pub use fabro_types::settings::user::{OutputFormat, PermissionLevel};
+/// Output format for the `fabro exec` / agent CLI.
+#[derive(
+    Clone, Copy, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize, clap::ValueEnum,
+)]
+#[serde(rename_all = "kebab-case")]
+pub enum OutputFormat {
+    Text,
+    Json,
+}
+
+/// Agent tool permission level.
+#[derive(
+    Clone, Copy, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize, clap::ValueEnum,
+)]
+#[serde(rename_all = "kebab-case")]
+pub enum PermissionLevel {
+    ReadOnly,
+    ReadWrite,
+    Full,
+}
 
 impl AgentArgs {
     /// Fill `None` fields from settings.toml values, then hardcoded defaults.

lib/crates/fabro-checkpoint/src/author.rs

@@ -1,7 +1,6 @@
 use std::fmt::Write;
 
-use fabro_types::settings::server::GitAuthorSettings;
-use fabro_types::settings::v2::InterpString;
+use fabro_types::settings::InterpString;
 use fabro_types::settings::v2::run::GitAuthorLayer;
 
 /// Resolved git author identity for checkpoint commits.
@@ -51,12 +50,6 @@ impl GitAuthor {
     }
 }
 
-impl From<&GitAuthorSettings> for GitAuthor {
-    fn from(value: &GitAuthorSettings) -> Self {
-        Self::from_options(value.name.clone(), value.email.clone())
-    }
-}
-
 impl From<&GitAuthorLayer> for GitAuthor {
     fn from(value: &GitAuthorLayer) -> Self {
         Self::from_options(

lib/crates/fabro-cli/src/user_config.rs

@@ -1,14 +1,22 @@
 use std::path::{Path, PathBuf};
 
 pub(crate) use fabro_config::user::*;
-pub(crate) use fabro_types::settings::user::ClientTlsSettings;
 
 use anyhow::{Result, bail};
 use fabro_config::ConfigLayer;
-use fabro_types::settings::v2::SettingsFile;
+use fabro_types::settings::SettingsFile;
 use fabro_util::version::FABRO_VERSION;
+use serde::{Deserialize, Serialize};
 use tracing::debug;
 
+/// Client-side TLS material for the CLI's remote server target.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+pub(crate) struct ClientTlsSettings {
+    pub cert: PathBuf,
+    pub key: PathBuf,
+    pub ca: PathBuf,
+}
+
 use crate::args::ServerTargetArgs;
 
 pub(crate) fn load_settings() -> anyhow::Result<SettingsFile> {

lib/crates/fabro-types/src/settings/mod.rs

@@ -25,7 +25,6 @@ pub mod project;
 pub mod run;
 pub mod sandbox;
 pub mod server;
-pub mod user;
 pub mod v2;
 
 pub use hook::{HookDefinition, HookEvent, HookSettings, HookType, TlsMode};
@@ -47,8 +46,6 @@ pub use server::{
     AuthSettings, FeaturesSettings, GitAuthorSettings, GitProvider, GitSettings, LogSettings,
     SlackSettings, TlsSettings, WebSettings, WebhookSettings, WebhookStrategy,
 };
-pub use user::{ClientTlsSettings, ExecSettings, OutputFormat, PermissionLevel, ServerSettings};
-
 // v2 top-level re-exports. Stage 6.5 of the settings TOML redesign
 // promoted the v2 namespaced parse tree to be the primary API surface;
 // consumers can now write `fabro_types::settings::SettingsFile` /

lib/crates/fabro-types/src/settings/user.rs

@@ -1,41 +0,0 @@
-use std::path::PathBuf;
-
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Copy, Debug, PartialEq, Deserialize, Serialize, crate::Combine)]
-#[cfg_attr(feature = "clap", derive(clap::ValueEnum))]
-#[serde(rename_all = "kebab-case")]
-pub enum OutputFormat {
-    Text,
-    Json,
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Deserialize, Serialize, crate::Combine)]
-#[cfg_attr(feature = "clap", derive(clap::ValueEnum))]
-#[serde(rename_all = "kebab-case")]
-pub enum PermissionLevel {
-    ReadOnly,
-    ReadWrite,
-    Full,
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub struct ClientTlsSettings {
-    pub cert: PathBuf,
-    pub key: PathBuf,
-    pub ca: PathBuf,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
-pub struct ServerSettings {
-    pub target: Option<String>,
-    pub tls: Option<ClientTlsSettings>,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
-pub struct ExecSettings {
-    pub provider: Option<String>,
-    pub model: Option<String>,
-    pub permissions: Option<PermissionLevel>,
-    pub output_format: Option<OutputFormat>,
-}