feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/contracts/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@pokemon-inventory/contracts",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./auth": "./auth.js",
+    "./inventory": "./inventory.js",
+    "./image": "./image.js",
+    "./listing": "./listing.js",
+    "./product": "./product.js"
+  }
+}