Implement CHUNK #2: server layer, core schemas/adapters, contract tests, seed

Complete the server-backed storage layer for PubScript so the app can run
against a real Fastify + SQLite backend instead of only local IndexedDB.

Server (@pubscript/server):
- db.ts: better-sqlite3 schema + migrations (users, shares, projects, books,
  chapters, entities, boards, ai_sessions, audit); WAL mode; idempotent
  admin bootstrap via PUBSCRIPT_ADMIN_EMAIL/PASSWORD.
- auth.ts: argon2 hashing, JWT-ish session tokens, guards, auth routes.
- routes.ts: REST CRUD for projects/books/chapters/entities/boards/ai_sessions
  with multi-tenant isolation and optimistic concurrency (baseRev).
- ws.ts: Fastify websocket hub for autosave + presence events.
- mapping.ts: row <-> core type conversion.

Core (@pubscript/core):
- Zod domain schemas (projects, books, chapters, entities, boards, ai_sessions)
  exported from index.
- storage-local.ts (IndexedDB/Dexie) and storage-server.ts (REST) adapters
  implementing the StorageAdapter contract.

Tests & tooling:
- storage.contract.test.ts: parameterized over both adapters; wired as
  `pnpm contract` and added to CI.
- seed.ts (`pnpm --filter server seed`): creates demo project "The Glass Harbor"
  — 3 chapters of prose, 4 linked characters, 1 world location, 6-node board.
- Dockerfile + compose wiring for the server runtime.

Acceptance: seed project opens with 3 chapters, 4 linked characters, 1 board.

packages/core/src/autosave.test.ts

@@ -0,0 +1,69 @@
+import { describe, it, expect, vi } from "vitest";
+import { createAutosave } from "./autosave.js";
+import type { StorageAdapter } from "./storage.js";
+import type { DocumentRef } from "./types.js";
+
+function mockAdapter(): StorageAdapter & { saved: DocumentRef[] } {
+  const saved: DocumentRef[] = [];
+  return {
+    saved,
+    async listProjects() {
+      return [];
+    },
+    async createProject() {
+      throw new Error("not implemented");
+    },
+    async getProject() {
+      throw new Error("not implemented");
+    },
+    async getChapter() {
+      return null;
+    },
+    async saveEntity() {},
+    async saveBoard() {},
+    async saveAISession() {},
+    async saveDocument(doc: DocumentRef) {
+      saved.push(doc);
+    },
+    onEvent() {
+      return () => {};
+    },
+  };
+}
+
+const ref: DocumentRef = {
+  id: "doc1",
+  projectId: "p1",
+  title: "Chapter 1",
+  rev: 0,
+  doc: { type: "doc", content: [] },
+};
+
+describe("autosave", () => {
+  it("debounces saves and reports status transitions", async () => {
+    const adapter = mockAdapter();
+    const as = createAutosave(adapter, { intervalMs: 50 });
+    const statuses: string[] = [];
+    as.onStatus((s) => statuses.push(s.status));
+
+    as.save(ref);
+    as.save(ref); // second save within window should not double-fire
+    expect(as.state.dirty).toBe(true);
+    expect(as.state.saving).toBe(true);
+
+    await vi.waitFor(() => expect(adapter.saved.length).toBe(1), { timeout: 500 });
+    expect(adapter.saved[0]!.id).toBe("doc1");
+    expect(as.state.dirty).toBe(false);
+    expect(as.state.saving).toBe(false);
+    expect(as.indicatorLabel()).toMatch(/✓ saved/);
+  });
+
+  it("flush persists immediately and clears dirty state", async () => {
+    const adapter = mockAdapter();
+    const as = createAutosave(adapter, { intervalMs: 10_000 });
+    as.save(ref);
+    await as.flush();
+    expect(adapter.saved.length).toBe(1);
+    expect(as.state.dirty).toBe(false);
+  });
+});