feat(core-dsr): handlers, dsrRouter, integration tests

Add four protocol-agnostic handlers (export, delete, rectify, restrict)
returning normalized { status, body, headers } responses, and a tRPC
dsrRouter via createDsrRouter(binding) following the factory pattern.

Auth checks: requireAuthenticated middleware gates all four procedures;
cascade-hard delete additionally requires admin role. Integration tests
assert happy-path response shapes, UNAUTHORIZED/FORBIDDEN error codes,
and error passthrough from the DSR service layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pnpm-lock.yaml

@@ -638,9 +638,15 @@ importers:
       "@repo/core-shared":
         specifier: workspace:*
         version: link:../core-shared
+      "@trpc/server":
+        specifier: ^11.0.0
+        version: 11.16.0(typescript@5.9.3)
       payload:
         specifier: ^3.0.0
         version: 3.81.0(graphql@16.13.2)(typescript@5.9.3)
+      zod:
+        specifier: ^3.24.0
+        version: 3.25.76
     devDependencies:
       "@repo/core-eslint":
         specifier: workspace:*