Shell/core import law: public API barrels + ESLint enforcement (stage 2)

The shell now imports through exactly two barrels, enforced by
import/no-restricted-paths (npm run lint):

  components/**  ->  "@/src/core"      (pure core API, browser-safe)
  app/**         ->  "@/src/core" + "@/src/server" (server entries)

Zone violations are lint errors with architecture-pointer messages; the
pure-core modules (contracts, question-core, plan-tree, phases, pending,
math-delims, ui-message) may never import agent/server/store.

Supporting moves (direction: IO layers -> core):
- core/index.ts: the core public API barrel
- core/ui-message.ts: moved from src/agent (it was shell-facing all along)
- quiz/ask input zod schemas moved agent/tools -> core/question-core
  (the question contract, alongside the grading logic)
- ChatRecord/ChatSummary moved store/chats -> core/contracts (single schema)
- GraphSnapshot/NodeStateClass moved core/graph -> core/contracts (the
  /api/graph payload IS a contract; the pure renderer needs only these)
- src/server/{chats,graph,jobs}.ts + index.ts: thin server entries for the
  transport layer; GET /api/graph's fold side-effect now lives behind
  graphView() instead of inline in the route

Gates: tsc clean, 190/190 tests, eslint clean (law verified to fire on
store/agent/subpath violations), production build clean.

(Repo repair en route: a git object (app/chat/[id] tree) was missing from
the object store — reconstructed byte-exactly via mktree from its blob;
the broken node_modules that stalled the build was cleanly reinstalled.)

src/core/ui-message.ts

@@ -0,0 +1,18 @@
+import type { UIMessage } from "ai";
+import type { AskToolInput, QuestionAnswerData, QuizToolInput } from "./question-core.ts";
+
+/**
+ * The typed UI message for the teacher chat — gives the frontend typed tool
+ * parts ("tool-quiz" / "tool-ask_user_question" with typed input/output)
+ * without importing the server-side agent into the client bundle.
+ *
+ * Declared explicitly (not via InferUITools) because a client-side tool has
+ * no execute function, so its OUTPUT type lives only here: the structured
+ * answer record the client builds and sends via addToolOutput.
+ */
+export type TeacherUITools = {
+	quiz: { input: QuizToolInput; output: QuestionAnswerData };
+	ask_user_question: { input: AskToolInput; output: QuestionAnswerData };
+};
+
+export type TeacherUIMessage = UIMessage<unknown, never, TeacherUITools>;