Add @trails-cool/api package with Zod schemas for REST API contract

Single source of truth for the Journal REST API:
- API_VERSION semver constant (1.0.0)
- Endpoint path constants (routes, activities, auth, uploads, push)
- Zod schemas for all request/response shapes:
  - Routes: list, detail, create, update, compute
  - Activities: list, detail, create
  - Auth: token exchange, refresh, device management
  - Discovery: instance info + API version
  - Uploads: presigned URL flow
  - Errors: structured error response with field-level details
- Cursor-based pagination schemas
- TypeScript types inferred from Zod (z.infer)

Used by Journal server (validation) and mobile client (type safety).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/api/src/auth.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+
+export const TokenExchangeRequestSchema = z.object({
+  grant_type: z.enum(["authorization_code", "refresh_token"]),
+  code: z.string().optional(),
+  code_verifier: z.string().optional(),
+  refresh_token: z.string().optional(),
+  client_id: z.string(),
+  redirect_uri: z.string().optional(),
+  device_name: z.string().max(100).optional(),
+});
+
+export const TokenResponseSchema = z.object({
+  access_token: z.string(),
+  refresh_token: z.string(),
+  token_type: z.literal("Bearer"),
+  expires_in: z.number(),
+});
+
+export const DeviceSchema = z.object({
+  id: z.string(),
+  deviceName: z.string().nullable(),
+  lastActiveAt: z.string().datetime(),
+  createdAt: z.string().datetime(),
+  isCurrent: z.boolean(),
+});
+
+export const DeviceListResponseSchema = z.object({
+  devices: z.array(DeviceSchema),
+});
+
+export type TokenExchangeRequest = z.infer<typeof TokenExchangeRequestSchema>;
+export type TokenResponse = z.infer<typeof TokenResponseSchema>;
+export type Device = z.infer<typeof DeviceSchema>;
+export type DeviceListResponse = z.infer<typeof DeviceListResponseSchema>;