feat(server): add versioned REST API for Extension clients - #165

Closes #164

Merge order and gate

This is step 3 of the intended issue order: #143 → #157 → #164.

• Wait for: both feat: support read-only external references across ct projects #143 and bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157 to be merged into main.
• Current state: draft; the branch contains both prerequisite issues, so GitHub currently shows their commits in this PR as well.
• After feat: support read-only external references across ct projects #143 merges: keep this PR in draft and update bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157 first.
• After bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157 merges: rebase/update this branch onto the new main, rerun all checks, verify that the remaining diff contains only feat(server): versioned REST API for ChurchTools Extension clients #164, and mark this PR ready for the REST design review.
• Merge last: Felix can accept, change, or reject the REST design without blocking feat: support read-only external references across ct projects #143 or bug(refs): resolve group statuses from /person/masterdata instead of treating #67 as permanent #157.

The source branches live in the bwl21/ct-cli fork. GitHub does not support cross-fork stacked PR bases, so this PR technically targets main; the draft state is the explicit merge-order gate.

What #164 adds

• one transport-neutral operation catalog for Commander, REST routing, capability discovery and OpenAPI
• versioned /api/v1 server with pairing, scoped sessions, workspace containment, idempotency, progress and structured errors
• immutable process-input snapshots and trusted local generators
• generated OpenAPI plus Scalar at /api/docs
• REST projections for feat: support read-only external references across ct projects #143 operations: use, unuse, unadopt, and ownership check
• security, parity, application and HTTP tests plus operator documentation

Verification

• npm run typecheck
• npm run lint
• npm run build
• npm test — 109 files passed, 2 skipped; 1166 tests passed, 5 skipped
• node .github/scripts/docs-staleness.mjs