feat(api-contract): add @chatbotx.io/api-contract package and implement public routers from it

[realcodesiman]

Summary

• Introduces packages/api-contract (46 files), a stable, versioned contract package (implement(contract) pattern) for the public v1 workspace-token API surface, replacing per-feature ad-hoc .route({...}) builder calls. A contract carries every field the OpenAPI generator needs (route, input, output, errors) independent of the handler implementation, so MCP tool names (derived from operationId) and hard-coded Postman/CLI paths stop drifting silently with unrelated refactors.
• Rewires 18 of the public router's workspace-token API modules onto the new contracts.
• Left three untouched: tags/api/token-auth.ts still calls tagService methods (create/update/deleteMany) that don't exist until PR-5's repository migration; contacts and webhooks (generic, not external-webhooks) aren't part of this contract migration at all yet — no contract module exists for either.

⚠️ Branch dependency

Stacked on #1065 (PR-1), #1066 (PR-2), and #1068 (PR-3) — merge those first for this diff to shrink to its own ~3k lines.

Bugs found and fixed during review (before this PR was opened)

• DB-import leak: inbox/resource.ts and whatsapp-message-template/resource.ts imported schema-only symbols from the bare @chatbotx.io/business package root, which transitively pulls in service modules that instantiate a Postgres Pool at module scope — undermining the whole point of a pure, testable-without-a-database contract package. Added dedicated schema-only subpath exports (business/inbox/schema, business/integration-whatsapp/schema) instead. Verified by tracing the full transitive import chain and by importing the package's entrypoint under a stripped env -i environment with zero errors.
• Silent validation regression: custom-field and bot-field create/update inputs used a bare z.string() for the name field instead of the shared zodFieldName() validator, dropping the guard against naming a field with the reserved bot_field: prefix (which would collide with the reference-token format the remap engine relies on). This bug pre-existed on the source migration branch too — not something introduced by extraction. Both now import zodFieldName() from @chatbotx.io/flow-config, matching the existing builder-side schemas exactly. Verified empirically: the schema now rejects a bot_field:-prefixed name and accepts a normal one.

Notes for reviewers

• apps/builder/__tests__/public-spec-snapshot.test.ts covers only the tags contract (/v1/tags) — its own docstring is scoped correctly, but be aware it is not yet a full-surface OpenAPI drift guard for the other ~19 contract modules this PR adds/rewires. Worth a follow-up to extend it to the merged public spec.
• Also fixes a stale packages/public-apis mention in AGENTS.md's package table and deletes the now-obsolete public-api-tooling skill doc.

Test plan

• `pnpm lint` — clean
• `pnpm --filter builder check-types`, `pnpm --filter @chatbotx.io/api-contract check-types`, `pnpm --filter @chatbotx.io/business check-types` — all clean
• `pnpm --filter builder test` — 2029/2029 passing
• `pnpm check:circular` — no new circular deps (69 pre-existing, unchanged, even after adding the `flow-config` dependency)
• `invariant-guard` agent review — found the two bugs above (both fixed and re-verified)
• `CI=true pnpm install --no-frozen-lockfile` run after adding the new workspace package and its `flow-config` dependency