refactor!: move route() into @zodapi/core so contracts carry no HTTP deps

[christensena]

Stacked on #19. Review that first; this PR's diff is against it.

Why

route() lived in @zodapi/hono, and its createRoute import pulled the @hono/zod-openapi barrel — hono, @asteasolutions/zod-to-openapi, openapi3-ts, yaml (~4.8MB installed) — into every package holding a contract. Bundlers that don't tree-shake within modules ship all of it to clients that never call it, and sideEffects: false can't help: the barrel runs extendZodWithOpenApi(z) at import time.

The eight lines of createRoute that route() actually used are inlined instead. getRoutingPath stays non-enumerable — an enumerable one leaks the function into {...route} spreads and the generated document.

The second half of the coupling was .openapi('User'): a prototype method that only exists because of that same import side effect. Zod's own .meta({ id: 'User' }) produces an identical component and $ref, so contracts use it now.

What

• route(), validationErrorResponse, ZodapiRoute, ZodapiRouteConfig → @zodapi/core
• ZodapiRouteConfig is expressed in zod types rather than re-exporting hono's RouteConfig. Request and response shapes are exact — they drive every inference; OpenAPI documentation fields are typed loosely, and anything they let through app.openapi() still catches. method drops OAS 3.2's 'query' to match RouteDef['method'], which drives the client.
• examples/api now depends on @zodapi/core + zod and nothing else

Breaking

@zodapi/hono is server-only: createApp(), plus OpenAPIHono and createRoute. Everything else it re-exported comes from @zodapi/core, and z comes from zod.

- import { queryArray, route, z } from '@zodapi/hono'
+ import { queryArray, route } from '@zodapi/core'
+ import { z } from 'zod'

hono peer narrows >=4.10.0 → ^4.10.0: core now models RouteConfig structurally, and an unbounded range let a future major widen it with no signal.

Verification

• The generated OpenAPI 3.1 document is byte-identical before and after (pnpm --filter @zodapi/example-app spec, 393 lines, empty diff) — the inlined createRoute and .meta({ id }) are exact substitutes.
• pnpm why hono --filter @zodapi/example-api and the same for @hono/zod-openapi: no matches.
• examples/app/src/server.ts typechecks unchanged, so app.openapi() still infers c.req.valid('param') and response-status narrowing from a core-built route.
• Build, typecheck, lint, format clean; 150 tests pass. The live client demo exercises 200/409/400/404.

-- Claude

🤖 Generated with Claude Code

https://claude.ai/code/session_01P4oNyS84DzZeNFzLGcw7rQ