Shell/core import law: public API barrels + ESLint enforcement (stage 2)

The shell now imports through exactly two barrels, enforced by
import/no-restricted-paths (npm run lint):

  components/**  ->  "@/src/core"      (pure core API, browser-safe)
  app/**         ->  "@/src/core" + "@/src/server" (server entries)

Zone violations are lint errors with architecture-pointer messages; the
pure-core modules (contracts, question-core, plan-tree, phases, pending,
math-delims, ui-message) may never import agent/server/store.

Supporting moves (direction: IO layers -> core):
- core/index.ts: the core public API barrel
- core/ui-message.ts: moved from src/agent (it was shell-facing all along)
- quiz/ask input zod schemas moved agent/tools -> core/question-core
  (the question contract, alongside the grading logic)
- ChatRecord/ChatSummary moved store/chats -> core/contracts (single schema)
- GraphSnapshot/NodeStateClass moved core/graph -> core/contracts (the
  /api/graph payload IS a contract; the pure renderer needs only these)
- src/server/{chats,graph,jobs}.ts + index.ts: thin server entries for the
  transport layer; GET /api/graph's fold side-effect now lives behind
  graphView() instead of inline in the route

Gates: tsc clean, 190/190 tests, eslint clean (law verified to fire on
store/agent/subpath violations), production build clean.

(Repo repair en route: a git object (app/chat/[id] tree) was missing from
the object store — reconstructed byte-exactly via mktree from its blob;
the broken node_modules that stalled the build was cleanly reinstalled.)

src/store/chats.ts

@@ -2,36 +2,14 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { UIMessage } from "ai";
 import { PATHS } from "../../config.ts";
-import type { PlanTree } from "../core/contracts.ts";
+import type { ChatRecord, ChatSummary, PlanTree } from "../core/contracts.ts";
 
 /**
- * Chat store — one JSON file per chat in data/chats/.
- *
- * The stored messages are full AI SDK UIMessages (parts included). This is
- * the canonical session record: a pending quiz is a tool part in
- * `input-available` state, which is exactly what makes resume-mid-question
- * free. The extraction pipeline (src/extract) will read these later; old pi
- * sessions (data/sessions) remain bootstrap input only.
+ * Chat store — one JSON file per chat in data/chats/. The record shape lives
+ * in core/contracts (ChatRecord/ChatSummary); this module is the fs adapter's
+ * implementation (the storage port formalizes this in a later stage).
  */
 
-export interface ChatRecord {
-	id: string;
-	title: string;
-	createdAt: string;
-	updatedAt: string;
-	messages: UIMessage[];
-	/** The session's plan tree (vision §2) — written by plan tools via saveTree. */
-	tree?: PlanTree;
-}
-
-export interface ChatSummary {
-	id: string;
-	title: string;
-	createdAt: string;
-	updatedAt: string;
-	messageCount: number;
-}
-
 function chatFile(id: string): string {
 	if (!/^[A-Za-z0-9_-]+$/.test(id)) throw new Error(`Invalid chat id: ${id}`);
 	return path.join(PATHS.chats, `${id}.json`);