feat(server): add Effect-first host routes and async factory (#72)

## Summary

Mount one secure provider-connection handler in either an Effect-native
or conventional async host. Identity, tenancy, continuations, provider
configuration, durable persistence, and policy remain host-owned.

## Usage

```ts
import { createDomainKit } from "domainkit/server";

const domainKit = await createDomainKit({
  baseURL: "https://app.example.com",
  identity,
  connectionPolicy,
  providers: [cloudflare],
  pendingAuthorizations,
  persistence,
});

app.all("/api/domainkit/*", (context) => domainKit.fetch(context.req.raw));
```

Effect applications retain explicit composition through `Server.make`,
`Server.layer`, and `Server.toWebHandler`.

## Flow

```text
authenticated POST /connection/start
  -> host identity + provider flow
  -> host-owned one-time continuation
  -> provider authorization URL
  -> GET /callback/:providerId
  -> consume continuation + persist connection
  -> validated same-origin redirect
```

Both entry styles run the same Effect route program. The async factory
requires host Promise persistence; it does not choose a database, run
migrations, dispose the host client, or add async CapsuleDB support.

## Validation

- `bun run lint`
- `bun run format:check`
- `bun run --cwd packages/domainkit release:check` — 156 package tests
and 7 packed-artifact tests, including Node, Bun, and workerd consumers
- docs reference check, offline audit, and production build
- `git diff --check`

The isolated Blume typecheck retains the pre-existing Astro/React/Bun
typing baseline (70 errors on this branch; 75 on current `main`).

## Follow-up scope

`@domainkit/capsuledb` remains an optional Effect-native persistence
package in the existing follow-up PR. A later Samva PR will adopt the
released API.