DEN-3828: admit private/server Zed contracts separately from public exports #69

Extend TJSV coverage beyond the public validation slice into private/server persistence and internal service contracts while preserving scope separation.

Acceptance:

• independently authored TypeSpec + JSON Schema peers for private/server scope;
• complete private declaration inventory and explicit exclusions;
• TJSV Contract IR/receipt for private scope separate from public receipts;
• browser/edge/client export checks must reject server-only declarations;
• server/admission tests may consume private contracts without making them public package exports;
• Diesel/SeaORM/SQL annotations cross-checked against the private contract inventory;
• no private model names in browser/edge generated bundles;
• sibling negative tests for accidental scope leakage.

Linear parent: DEN-3828. Related: DEN-2050, DEN-3959.