Implement CHUNK #2: server layer, core schemas/adapters, contract tests, seed

Complete the server-backed storage layer for PubScript so the app can run
against a real Fastify + SQLite backend instead of only local IndexedDB.

Server (@pubscript/server):
- db.ts: better-sqlite3 schema + migrations (users, shares, projects, books,
  chapters, entities, boards, ai_sessions, audit); WAL mode; idempotent
  admin bootstrap via PUBSCRIPT_ADMIN_EMAIL/PASSWORD.
- auth.ts: argon2 hashing, JWT-ish session tokens, guards, auth routes.
- routes.ts: REST CRUD for projects/books/chapters/entities/boards/ai_sessions
  with multi-tenant isolation and optimistic concurrency (baseRev).
- ws.ts: Fastify websocket hub for autosave + presence events.
- mapping.ts: row <-> core type conversion.

Core (@pubscript/core):
- Zod domain schemas (projects, books, chapters, entities, boards, ai_sessions)
  exported from index.
- storage-local.ts (IndexedDB/Dexie) and storage-server.ts (REST) adapters
  implementing the StorageAdapter contract.

Tests & tooling:
- storage.contract.test.ts: parameterized over both adapters; wired as
  `pnpm contract` and added to CI.
- seed.ts (`pnpm --filter server seed`): creates demo project "The Glass Harbor"
  — 3 chapters of prose, 4 linked characters, 1 world location, 6-node board.
- Dockerfile + compose wiring for the server runtime.

Acceptance: seed project opens with 3 chapters, 4 linked characters, 1 board.

packages/core/src/tokens.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect } from "vitest";
+import { countTokens, allocateBudget, DEFAULT_BUDGET } from "./tokens.js";
+
+describe("tokens", () => {
+  it("countTokens returns 0 for empty input", async () => {
+    expect(await countTokens("")).toBe(0);
+  });
+
+  it("counts tokens for a known string (approx)", async () => {
+    // ~4 chars per token is the rough heuristic; this asserts a sane range.
+    const n = await countTokens("The quick brown fox jumps over the lazy dog.");
+    expect(n).toBeGreaterThan(0);
+    expect(n).toBeLessThan(40);
+  });
+
+  it("allocateBudget respects percentages of total", () => {
+    const b = allocateBudget(DEFAULT_BUDGET);
+    expect(b.total).toBe(200_000);
+    // 10% system ≈ 20000, 40% context ≈ 80000, etc. (floor, so allow small slack).
+    expect(b.system).toBeCloseTo(20_000, -2);
+    expect(b.context).toBeCloseTo(80_000, -2);
+    expect(b.history).toBeCloseTo(60_000, -2);
+    expect(b.output).toBeCloseTo(40_000, -2);
+  });
+
+  it("budget slots sum approximately to total", () => {
+    const b = allocateBudget({ system: 25, context: 25, history: 25, output: 25 });
+    expect(b.system + b.context + b.history + b.output).toBeGreaterThan(199_990);
+    expect(b.total).toBe(200_000);
+  });
+
+  it("throws when percentages sum to zero", () => {
+    expect(() => allocateBudget({ system: 0, context: 0, history: 0, output: 0 })).toThrow(
+      /positive/,
+    );
+  });
+});