docs: the hosting contract every package codes against

The schema as applied (read back from production), the allowed values and the
conflict targets, the decisions taken where the spec left room, the JSON
shapes, the SQL functions and PHP hooks each package exposes, the API
contracts with one error shape and one Arabic error catalog, the manager
routes with their permission keys and the org-scope guard, file ownership,
the test harness, and notes for each package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>