Restructure into src/tests and add build foundation (M0)

Moves the scaffold to src/DodoSSH.Api and establishes the repo conventions the rest
of the milestones build on.

Structure:
- src/{Contracts,Crypto,Domain,Infrastructure,Api}, tests/{Contracts,Crypto,Domain}.Tests
- DodoSSH.slnx rewritten with src/ and tests/ solution folders

Build:
- Directory.Build.props centralises TFM, nullable, deterministic builds and
  TreatWarningsAsErrors; Directory.Packages.props pins every version centrally
- packages.lock.json committed so CI restores in locked mode
- NuGet.config clears machine-level sources, which both fixes NU1507 under central
  package management and makes restore reproducible off this machine
- Microsoft.OpenApi pinned to 2.11.0: ASP.NET Core 10.0.10 resolves 2.0.0, which is
  covered by GHSA-v5pm-xwqc-g5wc (high, patched in 2.7.5)

Analyzers:
- AnalysisLevel is Recommended, not All. With warnings-as-errors, All turns opinionated
  naming rules into build breaks and trains people to blanket-suppress.
- BannedSymbols.txt bans DateTime.UtcNow (TimeProvider), Guid.NewGuid (CreateVersion7),
  sync-over-async, MD5/SHA1, PBKDF2 and SecureString
- CA1711/CA1724 disabled: both are .NET Framework CAS-era naming rules
- PublicApiAnalyzers on Contracts only, since that assembly is the client's real contract

API:
- weather-forecast template removed
- UseHttpsRedirection removed; TLS terminates at the reverse proxy and redirecting
  behind one causes loops
- /healthz/{live,ready,startup}. Liveness deliberately checks no dependencies so a
  transient database outage cannot restart the container and kill live SSH sessions.

Notes:
- No coverage collector yet. Microsoft.Testing.Extensions.CodeCoverage pulls an MTP 1.x
  MSBuild extension that throws TypeLoadException against the MTP 2.3.x xunit.v3 brings.
  Coverage gates are an M3 concern; revisit with an MTP 2.x-aligned version then.

Verified: dotnet build (0 warnings), 17 tests pass, format check clean, API serves
health and OpenAPI endpoints.

src/DodoSSH.Contracts/ProblemCodes.cs

@@ -0,0 +1,48 @@
+namespace DodoSSH.Contracts;
+
+/// <summary>
+/// Stable machine-readable error codes returned in the <c>code</c> extension of an
+/// RFC 9457 ProblemDetails response.
+/// </summary>
+/// <remarks>
+/// These live in Contracts so the client switches on constants rather than parsing prose.
+/// The values are part of the public contract: add freely, never rename or repurpose.
+/// </remarks>
+public static class ProblemCodes
+{
+    /// <summary>The base URI that every problem <c>type</c> is formed under.</summary>
+    public const string TypeBaseUri = "https://dodossh.dev/problems/";
+
+    /// <summary>A push operation's <c>expectedVersion</c> did not match the stored row.</summary>
+    public const string VaultConflict = "vault-conflict";
+
+    /// <summary>The caller is authenticated but lacks the required permission.</summary>
+    public const string Forbidden = "forbidden";
+
+    /// <summary>The sync cursor was malformed, or failed its integrity tag.</summary>
+    public const string InvalidCursor = "invalid-cursor";
+
+    /// <summary>An <c>Idempotency-Key</c> was reused with a different request body.</summary>
+    public const string IdempotencyKeyReuse = "idempotency-key-reuse";
+
+    /// <summary>The caller has not yet enrolled a public key, so no vault is reachable.</summary>
+    public const string EnrollmentRequired = "enrollment-required";
+
+    /// <summary>Enrollment was attempted for a user who already holds a current key.</summary>
+    public const string AlreadyEnrolled = "already-enrolled";
+
+    /// <summary>The relay refused the requested target. Never states why, to avoid a probe oracle.</summary>
+    public const string RelayTargetRejected = "relay-target-rejected";
+
+    /// <summary>The relay ticket is expired, already used, or not valid for this node.</summary>
+    public const string RelayTicketInvalid = "relay-ticket-invalid";
+
+    /// <summary>A per-user or per-node relay session limit was reached.</summary>
+    public const string RelayLimitReached = "relay-limit-reached";
+
+    /// <summary>The client is older than the server's <c>minClientVersion</c>.</summary>
+    public const string ClientTooOld = "client-too-old";
+
+    /// <summary>A push batch exceeded the operation count or payload size cap.</summary>
+    public const string PushBatchTooLarge = "push-batch-too-large";
+}