fix(packages): declare runtime imports as production dependencies

@ekklesia/module-sdk imports drizzle-orm at run time but declared it
only as a peer and a development dependency. A workspace package is
linked into its consumers as a directory, so its imports resolve from
its own node_modules, where a consumer never satisfies a peer; a
production install omits development dependencies. In the production
image this made every module with a schema fail: the API exited at
startup and Doctor reported NOT READY.

- Move drizzle-orm to module-sdk's dependencies, keeping the peer.
- Move react to @ekklesia/ui's dependencies, keeping the peer. The new
  guard flags it the same way; it is bundled at build time today, so
  it was not a live failure. Both lockfile entries keep the identical
  resolution, so nothing new is installed and the shell bundles still
  contain one React.
- Add the boundary rule runtime-imports-are-production-dependencies:
  code a package ships (src/, bin/, excluding tests and .d.ts) must
  declare every runtime import in dependencies or optionalDependencies.
  Type-only imports are exempt; .tsx/.jsx implies react (automatic
  JSX runtime). Fixtures cover peer-only, dev-only, JSX, undeclared,
  and the accepted cases.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

pnpm-lock.yaml

@@ -201,6 +201,9 @@ importers:
       '@ekklesia/contracts':
         specifier: workspace:*
         version: link:../contracts
+      drizzle-orm:
+        specifier: 0.45.2
+        version: 0.45.2(@types/[email protected])([email protected])([email protected])
     devDependencies:
       '@biomejs/biome':
         specifier: 2.5.3
@@ -208,9 +211,6 @@ importers:
       '@types/node':
         specifier: 24.13.3
         version: 24.13.3
-      drizzle-orm:
-        specifier: 0.45.2
-        version: 0.45.2(@types/[email protected])([email protected])([email protected])
       typescript:
         specifier: 7.0.2
         version: 7.0.2
@@ -287,6 +287,9 @@ importers:
       '@ekklesia/design-tokens':
         specifier: workspace:*
         version: link:../design-tokens
+      react:
+        specifier: 19.2.8
+        version: 19.2.8
     devDependencies:
       '@biomejs/biome':
         specifier: 2.5.3
@@ -306,9 +309,6 @@ importers:
       happy-dom:
         specifier: 20.0.11
         version: 20.0.11
-      react:
-        specifier: 19.2.8
-        version: 19.2.8
       react-dom:
         specifier: 19.2.8
         version: 19.2.8([email protected])