Shell/core import law: public API barrels + ESLint enforcement (stage 2)

The shell now imports through exactly two barrels, enforced by
import/no-restricted-paths (npm run lint):

  components/**  ->  "@/src/core"      (pure core API, browser-safe)
  app/**         ->  "@/src/core" + "@/src/server" (server entries)

Zone violations are lint errors with architecture-pointer messages; the
pure-core modules (contracts, question-core, plan-tree, phases, pending,
math-delims, ui-message) may never import agent/server/store.

Supporting moves (direction: IO layers -> core):
- core/index.ts: the core public API barrel
- core/ui-message.ts: moved from src/agent (it was shell-facing all along)
- quiz/ask input zod schemas moved agent/tools -> core/question-core
  (the question contract, alongside the grading logic)
- ChatRecord/ChatSummary moved store/chats -> core/contracts (single schema)
- GraphSnapshot/NodeStateClass moved core/graph -> core/contracts (the
  /api/graph payload IS a contract; the pure renderer needs only these)
- src/server/{chats,graph,jobs}.ts + index.ts: thin server entries for the
  transport layer; GET /api/graph's fold side-effect now lives behind
  graphView() instead of inline in the route

Gates: tsc clean, 190/190 tests, eslint clean (law verified to fire on
store/agent/subpath violations), production build clean.

(Repo repair en route: a git object (app/chat/[id] tree) was missing from
the object store — reconstructed byte-exactly via mktree from its blob;
the broken node_modules that stalled the build was cleanly reinstalled.)

eslint.config.mjs

@@ -0,0 +1,62 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextPlugin from "@next/eslint-plugin-next";
+import tsParser from "@typescript-eslint/parser";
+import importPlugin from "eslint-plugin-import";
+
+/**
+ * ESLint with one job here: ENFORCE THE IMPORT LAW (the shell/core
+ * architecture, docs/architecture.md). Everything else stays out of the
+ * way — this is not a style linter.
+ *
+ *   components/**  →  "@/src/core"  (the pure core barrel) — ONLY
+ *   app/**         →  "@/src/core" + "@/src/server" (the server barrel) — ONLY
+ *   pure core      →  never imports src/agent, src/server, src/store
+ *
+ * tests/ and scripts/ are internal — unrestricted.
+ */
+
+export default defineConfig([
+	globalIgnores([".next/**", "node_modules/**", "data/**", "next-env.d.ts", "scripts/**"]),
+	{
+		files: ["**/*.{js,mjs,ts,tsx}"],
+		languageOptions: {
+			parser: tsParser,
+			parserOptions: { ecmaVersion: "latest", sourceType: "module" },
+		},
+		plugins: { "@next/next": nextPlugin, import: importPlugin },
+		settings: {
+			"import/resolver": { typescript: { alwaysTryTypes: true } },
+		},
+		rules: {
+			...nextPlugin.configs.recommended.rules,
+			"import/no-restricted-paths": [
+				"error",
+				{
+					zones: [
+						{
+							target: "./components",
+							from: "./src",
+							// NOTE: the plugin resolves `except` relative to the zone's `from` path.
+							except: ["./core/index.ts"],
+							message:
+								"Browser shell imports ONLY the pure core barrel: `from \"@/src/core\"` (architecture: docs/architecture.md).",
+						},
+						{
+							target: "./app",
+							from: "./src",
+							except: ["./core/index.ts", "./server/index.ts"],
+							message:
+								"app/ (transport + server components) imports ONLY the barrels: `@/src/core` and `@/src/server` (architecture: docs/architecture.md).",
+						},
+						{
+							target: "./src/core/{index,contracts,question-core,plan-tree,phases,pending,math-delims,ui-message}.ts",
+							from: ["./src/agent", "./src/server", "./src/store"],
+							message:
+								"Pure core modules never import IO layers (agent/server/store). IO-bound core (graph.ts, graph-context.ts) is exempt until the storage-port stage inverts it.",
+						},
+					],
+				},
+			],
+		},
+	},
+]);