Organise facades into subdirectories:
 - facades/agent
 - facades/client
 - facades/controller

There are a few facades that do not have
an obvious home:

 - storageprovisioner is run by the controllers
   (for model-level storage), and on machine
   agents (for machine-level storage).
 - imagemetadata is, unfortunately, serving two
   purposes: it serves the client, for listing,
   adding and removing image metadata; and it
   serves the image metadata worker. Because the
   image metadata client code is behind a feature
   flag, we could probably break API compatibility,
   and make it worker-only. I've left it alone for
   now, and put it in the facades/client package.
 - migrationtarget is for controllers to talk to
   each other, but it accepts only client
   authentication. Nevertheless, I've put it in the
   facades/controller package.

And then there were some bugs in facade auth:

 - logfwd was using AuthMachineAgent, and should
   have used AuthController. It has been updated
   to use the latter.
 - payloads had no auth at all; it has been updated
   to use AuthClient.
 - metricsmanager and undertaker: redundant calls
   to AuthMachineAgent, when AuthController would
   do. Simplified.
 - charmrevisionupdater: was allowing non-controller
   agents, now does not.
 - keymanager and highavailability: both were allowing
   controller unnecessarily; dropped.