feat(appservice): @mosaicstack/appservice — Matrix AS core (M4a, agent-comms#9)

First phase of mosaic-as per agent-comms docs/design/M4-MOSAIC-AS.md:
- TransactionHandler: AS transactions endpoint logic with timing-safe
  hs_token verification (Bearer + legacy access_token), bounded txnId
  dedupe (documented at-least-once limitation), handler error isolation
- AppserviceIntent: virtual user registration (m.login.application_service),
  user_id impersonation, invite-then-join fallback, thread-aware sends
  (m.thread + is_falling_back), typing, display names, uuid txn ids
- Registration builder + hardened YAML serializer (control-char rejection,
  quote escaping) for the Synapse mosaic-as.yaml
- bridge.dto.ts validators for the agent-comms daemon bridge API
Zero runtime deps; strict ESM/NodeNext; 14 vitest tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pnpm-lock.yaml

@@ -297,6 +297,18 @@ importers:
         specifier: ^2.0.0
         version: 2.1.9(@types/node@24.12.0)(jsdom@29.0.0(@noble/hashes@2.0.1))(lightningcss@1.31.1)
 
+  packages/appservice:
+    devDependencies:
+      '@types/node':
+        specifier: ^22.0.0
+        version: 22.19.15
+      typescript:
+        specifier: ^5.8.0
+        version: 5.9.3
+      vitest:
+        specifier: ^2.0.0
+        version: 2.1.9(@types/node@22.19.15)(jsdom@29.0.0(@noble/hashes@2.0.1))(lightningcss@1.31.1)
+
   packages/auth:
     dependencies:
       '@mosaicstack/db':