Extract a framework-agnostic identity-core frontend package

[sneridagh]

First phase of #132. Moves what the Volto add-on can share with a future Aurora add-on into a new package, @plone-collective/identity-core. Nothing changes for a site.

What moved

• To frontend/packages/identity-core, with their tests:
  • the REST payload types (types/api.ts, types/blocks.ts)
  • the vocabulary names
  • 15 helpers that need no frontend framework
• An endpoint table, endpoints, covering every REST path the frontend calls. The Volto actions now build their paths from it. The existing action tests check exact paths and pass unchanged, so the table reproduces every path, including the two that aren't percent-encoded. That is safe for loginProvider: the backend only accepts ids matching ^[A-Za-z0-9_-]+$. user(userid) keeps the unencoded path from before; this PR changes no path.
• avatar was split. The colour logic is in core and takes the palette as a parameter. The Volto module only supplies config.settings.identity.avatarColors.
• expandedProfile stays in the Volto add-on, because it reads Volto's Redux content slice.

The boundary

An ESLint override in frontend/.eslintrc.js rejects any Volto, Aurora, React, Redux, router or i18n import in identity-core. I checked that it fires: a file in core importing react and a Volto helper fails lint. Core imports no React, so its source can be shared between two dev setups without bundling two Reacts.

Also changed

• frontend/Dockerfile copies the new package; otherwise the image build would fail on the workspace:* dependency.
• The root test and typecheck scripts run core too. Core's tests use plain vitest and need neither Volto nor Aurora.
• volto-identity lists core in addons, so Volto transpiles its TypeScript source. That is also why core default-exports a no-op applyConfig.
• Docs: AGENTS.md and contributing.md list the package and its news scope; reference/frontend.md source citations were updated.

Not covered: release

repoplone publishes exactly one frontend package, so it cannot release identity-core yet. This needs settling before the next release, or volto-identity will ship depending on a package that isn't on npm. The options are in #132.

For integrators: code that imported one of the moved helpers by its @plone-collective/volto-identity/helpers/... path now imports it from @plone-collective/identity-core. The volto-identity news fragment says so.

Checks

Check	Result
Tests	Before: 84 files, 886 tests passing. Now: core 14 files / 185 tests, Volto 73 files / 741 tests. That's the baseline plus 40 new tests in two new files (endpoint table 30, avatar 10).
make -C frontend lint (ESLint with zero warnings, typecheck for both packages, prettier, stylelint)	Passes
make docs-build	Passes
make -C docs vale	0 errors
pnpm i18n	Message catalogue unchanged
Root make check	Not run: its backend half needs a backend install that checkout doesn't have, and this PR touches no backend code

[sneridagh]

LGTM, let's continue with the next one, stack them on the top of it