Adopt @seamless-auth/types and drop the duplicated local schemas

[Bccorb]

fells-code/seamless-auth-types#4 consolidates the contracts this repo shares with the SDKs, the dashboard, and the CLI. Once that release is published, most of src/schemas/ becomes a re-export.

Schemas that now exist in @seamless-auth/types and can be deleted here:

• src/lib/scopedRoles.ts and src/schemas/roles.schema.ts (the server maintained its own copy of the same logic, see fells-code/seamless-auth-server)
• src/schemas/systemConfig.schema.ts and src/schemas/systemConfig.patch.schema.ts
• src/schemas/authEvent.types.ts
• src/schemas/user.schema.ts (ApiUserSchema)
• src/schemas/organization.requests.ts and src/schemas/organization.responses.ts
• src/schemas/oauth.{requests,responses}.ts and src/schemas/oauthProviders.{requests,responses}.ts
• src/schemas/webauthn.{requests,responses}.ts
• src/schemas/totp.{requests,responses}.ts and src/schemas/stepUp.responses.ts
• src/schemas/me.response.ts
• src/schemas/internalMetrics.responses.ts and the metrics half of src/schemas/internal.query.ts
• src/schemas/admin.{query,requests,responses}.ts
• src/schemas/auth.{requests,responses}.ts, registration.*, otp.*, magiclink.*, session.*, credential.responses.ts, and the envelopes in generic.responses.ts

Two things that stay local because they depend on this repo's runtime:

• The PRF salt validation in webauthn.requests.ts. The shared schema asserts the wire shape only, so assertValidPrfSalt still needs to run here, either as a .superRefine on top of the shared schema or in the handler.
• jwks.responses.ts, which no other repo consumes.

Behavior differences to expect when adopting:

• TransportSchema is wider, see Passkey transports outside usb/ble/nfc/internal may be rejected #123.
• OrganizationSchema timestamps are parsed as ISO dates rather than z.any(), so createdAt and updatedAt become strings on the way out.
• AUTH_EVENT_TYPES gained magic_link_failed relative to the dashboard's copy and dropped the bootstrap_admin_* entries.

One note for OAuthProviderUpdateSchema: fields that carry a default still resolve to that default when the caller omits them, so updateOAuthProvider must keep merging req.body rather than the parsed output. That is what it does today, so nothing to change, but it is easy to break in a refactor.

[Bccorb]

Adopted in #128. Three schemas had to stay local because the shared versions are looser than this server's behavior, or in one case contradict it: the delivery union's magic_link_email.token, the anomaly event's type, and AUTH_EVENT_TYPES still carrying the 15 never-emitted types removed in #127.

All three are filed upstream as fells-code/seamless-auth-types#13. When they land, those carve-outs can be deleted and AuthEventQuerySchema can come from the package too.