feat: support read-only external references across ct projects

[bwl21]

Closes #143

Merge order and gate

This is step 1 of the intended issue order: #143 → #157 → #164.

• Wait for: nothing; this is the foundation and may be reviewed and merged first.
• Do now: review and merge feat: support read-only external references across ct projects #143 into main.
• After merge: rebase/update bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157 onto the new main, rerun its checks, and mark it ready for review.
• Do not merge yet: bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157 or feat(server): versioned REST API for ChurchTools Extension clients #164. They intentionally remain drafts until their prerequisites have landed.

The source branches live in the bwl21/ct-cli fork. GitHub does not support cross-fork stacked PR bases, so all three PRs technically target main; the draft gates enforce the order manually.

Summary

• add state v2 external bindings with in-memory v1 migration and globally unique logical keys
• add generic registry-backed ct use, ct unuse, state listing/removal/rekeying, and live hard-identity validation
• resolve external resources read-only across hierarchy, dynamic rulesets, permissions, and other logical reference positions without admitting them to apply or destroy inputs
• add structured blocking diagnostics and ct ownership check for explicit cross-project coordination scopes
• document the ownership model, CLI workflow, identity contract, and all supported resource types

Verification

• npm test -- --reporter=dot — 1141 passed, 5 skipped
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build
• node .github/scripts/docs-staleness.mjs