core: share validation schemas between backend and frontend

[joelpeace48-cell]

Problem

The backend validates with zod; the frontend will need the same shapes for
forms and API responses. Two hand-maintained copies of a schema always drift,
and the drift surfaces as a runtime validation error in production rather than a
type error at build time.

What to do

• Extract shared zod schemas into a package consumable by both — a small
  published package, or a workspace shared via git submodule given the repos are
  separate.
• Derive TypeScript types from the schemas rather than declaring them twice.
• Version it, and treat a schema change as a breaking change requiring a
  coordinated release across repos.
• Generate the OpenAPI document from the same schemas so documentation cannot
  drift either.

Acceptance criteria

• Shared schema package consumed by both repos
• Types derived, never hand-written alongside a schema
• Versioned with a documented compatibility policy
• OpenAPI generated from the same source

Notes

The three repos being separate makes this harder than a monorepo would. Worth
doing anyway — the alternative is discovering the mismatch in production.