feat(appservice): @mosaicstack/appservice — Matrix AS core (M4a, agent-comms#9)

First phase of mosaic-as per agent-comms docs/design/M4-MOSAIC-AS.md:
- TransactionHandler: AS transactions endpoint logic with timing-safe
  hs_token verification (Bearer + legacy access_token), bounded txnId
  dedupe (documented at-least-once limitation), handler error isolation
- AppserviceIntent: virtual user registration (m.login.application_service),
  user_id impersonation, invite-then-join fallback, thread-aware sends
  (m.thread + is_falling_back), typing, display names, uuid txn ids
- Registration builder + hardened YAML serializer (control-char rejection,
  quote escaping) for the Synapse mosaic-as.yaml
- bridge.dto.ts validators for the agent-comms daemon bridge API
Zero runtime deps; strict ESM/NodeNext; 14 vitest tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/appservice/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@mosaicstack/appservice",
+  "version": "0.0.1",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
+    "directory": "packages/appservice"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint src",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^2.0.0"
+  },
+  "publishConfig": {
+    "registry": "https://git.mosaicstack.dev/api/packages/mosaicstack/npm/",
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ]
+}