Extract @codra/schema, shared contracts as a standalone package

[devarshishimpi]

Why

src/shared is already the closest thing to a contract layer: api.ts, schema.ts, schema-enums.ts, schema-claims.ts, schema-repo-config.ts, review-limits.ts, timezone.ts, hex.ts, transient-errors.ts. It's imported by both the Worker and the dashboard through an alias, which means neither side has a declared dependency on it. It has to move first, every other package will depend on it.

Scope

• Move src/shared to packages/schema/src, exporting zod schemas, inferred types, and the API request/response contracts.
• Zero runtime dependencies beyond zod. No Hono types, no Cloudflare types, no React.
• Split src/shared/github.ts out: it's GitHub webhook payload typing, not generic shared schema. For now, move it to packages/schema/src/github.ts as-is if the provider-github package doesn't exist yet, and leave a comment noting it will move again in the git-provider issue. If that issue has already landed, move it straight to packages/provider-github instead.
• Add subpath exports (@codra/schema/api, /review, /config) in packages/schema/package.json so consumers pull only what they use.
• Update every import site across src/server and src/client from @shared/* to @codra/schema/* (or the package root), then remove the @shared alias from tsconfig.json and vite.config.ts.

Acceptance criteria

• No file in packages/schema imports from any other workspace package.
• Both the server and client trees consume it as a declared workspace dependency; the @shared/* alias is gone from tsconfig.json and vite.config.ts.
• packages/schema typechecks and has its own test setup (move any schema-focused tests from test/ that fit here).
• npm run build produces the same client bundle size as before (no regression from the extra package boundary).
• npm test, npm run lint, npm run typecheck pass at the root.