Stabilize setup and status JSON output

[joerucci]

Summary

• Adds explicit JSON response DTOs for setup --json and status --json instead of exposing raw domain structs.
• Uses stable lower-camel project fields like schema, id, packageManager, scanIgnores, and environments.
• Sanitizes status device and access request payloads so compatibility/signature fields such as device_id and client_sig are not exposed through status JSON.
• Adds tests that reject the old raw ProjectManifest field shape and device signature aliases.

Why

setup --json and status --json are developer-facing machine-readable surfaces. Exposing internal struct names and signed-record compatibility fields made the output look unstable and implementation-driven.

Validation

• go test ./internal/app
• make check
• Rebuilt CLI and smoke-tested setup --json and status --json output shape locally.

Replaces closed PR #17 after renaming the branch to remove the previous branch prefix.