feat: @dripnex/contracts — shared zod schema package for all services

[tomymaritano]

Context

Contracts-first is the mitigation for microservices overhead: every request/response/event schema lives in ONE versioned package; services and the desktop client all consume it.

Acceptance criteria

• packages/contracts publishing @dripnex/contracts: zod schemas for auth (magic link, session, tokens), sync (push/pull/conflict), licensing envelope, plugin registry entries, billing webhook events
• Schemas extracted from current code (apiClient.ts, packages/api routes, sync-core types) — no behavior change, just codification
• Desktop apiClient + packages/api both import from contracts (proves single source of truth BEFORE any split)
• Versioning via changesets; breaking schema change = major + documented migration note
• CI contract tests: packages/api responses validate against schemas

Depends on

Service boundaries RFC (scope per service).