Implement CHUNK #2: server layer, core schemas/adapters, contract tests, seed

Complete the server-backed storage layer for PubScript so the app can run
against a real Fastify + SQLite backend instead of only local IndexedDB.

Server (@pubscript/server):
- db.ts: better-sqlite3 schema + migrations (users, shares, projects, books,
  chapters, entities, boards, ai_sessions, audit); WAL mode; idempotent
  admin bootstrap via PUBSCRIPT_ADMIN_EMAIL/PASSWORD.
- auth.ts: argon2 hashing, JWT-ish session tokens, guards, auth routes.
- routes.ts: REST CRUD for projects/books/chapters/entities/boards/ai_sessions
  with multi-tenant isolation and optimistic concurrency (baseRev).
- ws.ts: Fastify websocket hub for autosave + presence events.
- mapping.ts: row <-> core type conversion.

Core (@pubscript/core):
- Zod domain schemas (projects, books, chapters, entities, boards, ai_sessions)
  exported from index.
- storage-local.ts (IndexedDB/Dexie) and storage-server.ts (REST) adapters
  implementing the StorageAdapter contract.

Tests & tooling:
- storage.contract.test.ts: parameterized over both adapters; wired as
  `pnpm contract` and added to CI.
- seed.ts (`pnpm --filter server seed`): creates demo project "The Glass Harbor"
  — 3 chapters of prose, 4 linked characters, 1 world location, 6-node board.
- Dockerfile + compose wiring for the server runtime.

Acceptance: seed project opens with 3 chapters, 4 linked characters, 1 board.

apps/web/src/routes/AI.tsx

@@ -0,0 +1,32 @@
+import { Button, Input, toast } from "@pubscript/ui";
+
+export function AI() {
+  return (
+    <div className="ps-content">
+      <h1 style={{ margin: "0 0 16px", fontSize: 24 }}>AI Assistant</h1>
+      <p className="ps-settings-desc" style={{ marginBottom: 20 }}>
+        Local-first AI: prompts run against your configured provider. Nothing leaves your machine unless you allow it.
+      </p>
+
+      <Input
+        label="Prompt"
+        placeholder="Summarize Mara's arc so far…"
+        style={{ width: "100%", marginBottom: 12 }}
+      />
+      <div style={{ display: "flex", gap: 10 }}>
+        <Button variant="primary" onClick={() => toast.success("Prompt queued locally.")}>Run locally</Button>
+        <Button variant="secondary">Refine character</Button>
+        <Button variant="secondary">Outline next chapter</Button>
+      </div>
+
+      <div style={{ marginTop: 24, padding: 16, background: "var(--ps-surface)", border: "1px solid var(--ps-border)", borderRadius: 8 }}>
+        <h3 style={{ marginTop: 0, fontSize: 14 }}>Privacy</h3>
+        <ul style={{ margin: 0, paddingLeft: 18, lineHeight: 1.8, fontSize: 14 }}>
+          <li>Documents are never uploaded without explicit consent.</li>
+          <li>Context is chunked to stay within the token budget.</li>
+          <li>Session history is stored locally and deletable.</li>
+        </ul>
+      </div>
+    </div>
+  );
+}