Eliminate direct app.state access from routers

Docs/Tasks.md

@@ -20,6 +20,7 @@ Reference: `Docs/Refactoring.md` for full analysis of each issue.
    - Issue: Several routers still read or mutate `app.state` directly, including `setup.py` and `config.py`, which breaks the intended separation of concerns and makes handlers harder to test.
    - Propose: Refactor routers to consume explicit dependencies for required values and actions, and move all direct state mutations into services or dedicated state managers.
    - Test: Ensure all router handlers compile without requiring direct `app.state` access and existing endpoint tests still pass.
+   - Status: completed
 
 3. Replace process-local session cache with a pluggable abstraction
    - Goal: Make session validation consistent across multi-worker deployments by replacing the module-level in-memory cache with an injectable cache backend.