feat(contracts,db): Pi upstream contracts and pi_upstream table

- contracts/pi.ts: 41 builtin provider ids + openai-compatible + fake, auth kinds,
  upstream row/view/create/update, provider capability table (oauth modes, termsNote),
  test/models/oauth start/complete schemas
- settings.pi gains defaultUpstreamId; legacy single-upstream fields kept for fallback
- api.ts: /pi/providers, /pi/upstreams CRUD, test, models, oauth start/complete/logout
  (writes and login are console-session only)
- migration 0027: pi_upstream, agent_run.upstream_id, one-time conversion of saved
  legacy settings.pi into a default upstream

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/index.ts

@@ -14,6 +14,7 @@ export * from "./identity.ts";
 export * from "./instances.ts";
 export * from "./ops.ts";
 export * from "./organization.ts";
+export * from "./pi.ts";
 export * from "./policy.ts";
 export * from "./redact.ts";
 export * from "./settings.ts";