epic: strengthen core so new framework adapters reuse more

[Bccorb]

Summary (epic)

The core/adapter boundary is clean (zero Express imports in core), but core is under-weighted: it owns per-endpoint upstream calls yet not the delivery, cookie-format, service-token, proxy, or contract logic every adapter needs. Strengthening core lets us spin off new framework adapters (Fastify, Hono, Koa, Next.js) with far less reimplementation. This is a tracking epic; sub-items should land as separate small PRs.

Sub-items (highest leverage first)

• Add core.proxyRequest({ authServerUrl, path, method, authorization, forwardedClientIp, query, body }) -> { status, body }. The ~30 organizations/step-up/totp/users passthrough routes exist only in proxyWithIdentity (packages/express/src/createServer.ts:190-246,332-560) with no core equivalent. Fold in the querystring builder duplicated 3x (createServer.ts:91-110, core/src/handlers/admin.ts:23-33, core/src/handlers/internalMetrics.ts:19-28).
• Move message delivery into core: relocate packages/express/src/internal/deliverAuthMessage.ts beside packages/core/src/authMessaging.ts, and delete the near-verbatim duplicate packages/express/src/messaging.ts (two sources of truth for the messaging contract), re-exporting the types from core.
• Extract the two copy-pasted core session helpers: verifySignedAuthResponse + sub-check, and session-cookie payload build, each repeated ~7x across login/finish/oauth/otp/magic/switch handlers. Introduce a typed UpstreamSessionResponse (upstream fields are read as any today).
• Centralize the adapter contract: route path strings, the x-seamless-auth-delivery-mode: "external" literal (register.ts:41 and 3 more), and the external-delivery token identity (buildInternalServiceAuthorization) so cross-repo changes with seamless-auth-api are single-edit.
• Tidy core's public surface: export admin, sessions, internalMetrics, systemConfig, bootstrapAdminInvite, verifySignedAuthResponse, verifyRefreshCookie from packages/core/src/index.ts (currently subpath-only).
• Adapter DRY: cookieSigner block copied 8x, set-cookie loop 7x, handle(res,result) 3x+, routeParam 3x.
• DX for future adapters: injectable logger in core (it writes to console directly), which matters for serverless/edge adapters.

Note

Issue-only for now; not being fixed in the current batch. Sub-items to be scheduled as their own reviewable PRs.