feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

packages/contracts/src/identity.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+
+export const ekklesiaUserIdSchema = z.string().trim().min(1).max(128);
+
+export type EkklesiaUserId = z.infer<typeof ekklesiaUserIdSchema>;
+
+export function parseEkklesiaUserId(input: unknown): EkklesiaUserId {
+  return ekklesiaUserIdSchema.parse(input);
+}
+
+export function safeParseEkklesiaUserId(input: unknown): z.ZodSafeParseResult<EkklesiaUserId> {
+  return ekklesiaUserIdSchema.safeParse(input);
+}
+
+export interface EkklesiaAnonymousPrincipal {
+  readonly kind: "anonymous";
+}
+
+export interface EkklesiaAuthenticatedPrincipal {
+  readonly kind: "authenticated";
+  readonly userId: EkklesiaUserId;
+}
+
+export type EkklesiaPrincipal = EkklesiaAnonymousPrincipal | EkklesiaAuthenticatedPrincipal;
+
+export const ANONYMOUS_PRINCIPAL: EkklesiaAnonymousPrincipal = Object.freeze({
+  kind: "anonymous",
+});
+
+export function createAuthenticatedPrincipal(userId: unknown): EkklesiaAuthenticatedPrincipal {
+  return Object.freeze({
+    kind: "authenticated",
+    userId: parseEkklesiaUserId(userId),
+  });
+}
+
+export function isAnonymousPrincipal(
+  principal: EkklesiaPrincipal,
+): principal is EkklesiaAnonymousPrincipal {
+  return principal.kind === "anonymous";
+}
+
+export function isAuthenticatedPrincipal(
+  principal: EkklesiaPrincipal,
+): principal is EkklesiaAuthenticatedPrincipal {
+  return principal.kind === "authenticated";
+}