feat(core-dsr): handlers, dsrRouter, integration tests

Add four protocol-agnostic handlers (export, delete, rectify, restrict)
returning normalized { status, body, headers } responses, and a tRPC
dsrRouter via createDsrRouter(binding) following the factory pattern.

Auth checks: requireAuthenticated middleware gates all four procedures;
cascade-hard delete additionally requires admin role. Integration tests
assert happy-path response shapes, UNAUTHORIZED/FORBIDDEN error codes,
and error passthrough from the DSR service layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-dsr/src/index.ts

@@ -35,3 +35,16 @@ export { InMemoryProcessingRestriction } from "./in-memory-processing-restrictio
 export { bindProductionDsr } from "./di/bind-production";
 export type { DsrBinding, BindProductionDsrOpts } from "./di/bind-production";
 export { bindDevSeedDsr } from "./di/bind-dev-seed";
+
+export { createDsrRouter, dsrRouter } from "./dsr.router";
+export type { DsrRouter, DsrTrpcUser } from "./dsr.router";
+
+export type { HandlerResponse } from "./handlers/handler-types";
+export { createExportHandler } from "./handlers/export-handler";
+export type { ExportHandlerInput } from "./handlers/export-handler";
+export { createDeleteHandler } from "./handlers/delete-handler";
+export type { DeleteHandlerInput } from "./handlers/delete-handler";
+export { createRectifyHandler } from "./handlers/rectify-handler";
+export type { RectifyHandlerInput } from "./handlers/rectify-handler";
+export { createRestrictHandler } from "./handlers/restrict-handler";
+export type { RestrictHandlerInput } from "./handlers/restrict-handler";