feat(core-shared): add PII and retention type primitives

Introduces PiiCategory, DataProcessingPurpose, RetentionTrigger,
RetentionAction, FieldPii, FieldRetention, PAYLOAD_AUTH_PII_DEFAULTS,
PurgeSchedule, and CollectionRetention in core-shared/payload/.
Augments payload's FieldCustom and CollectionCustom interfaces via
ambient declaration so downstream collection configs gain typed
custom.pii and custom.retention / custom.authPii fields.

Credential fields (password, salt, hash, resetPasswordToken,
resetPasswordExpiration, loginAttempts, lockUntil, apiKey, apiKeyIndex)
are null in PAYLOAD_AUTH_PII_DEFAULTS to exclude security material
from DPA mapping. Adds @vitest/coverage-v8 and coverage exclusions
for boilerplate infrastructure files so coverage:diff is gated on
new executable code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/vitest.config.ts

@@ -3,6 +3,24 @@ import { mergeConfig } from "vitest/config";
 import { nodeVitestConfig } from "@repo/core-typescript/vitest.base.node";
 
 export default mergeConfig(nodeVitestConfig, {
+  test: {
+    coverage: {
+      exclude: [
+        // Ambient declaration files have no runtime code
+        "src/**/*.d.ts",
+        // Pure TypeScript interface files — erased at runtime, not unit-testable
+        "src/**/*.interface.ts",
+        // DI symbol constants — boilerplate, covered implicitly by bind-* tests
+        "src/**/symbols.ts",
+        // tRPC context factory — wired at app bootstrap, not unit-testable
+        "src/trpc/context.ts",
+        // Sentry client init — browser/node SDK init, tested in apps
+        "src/instrumentation/sentry/**",
+        // Pure type-alias file — no executable code
+        "src/payload/retention-types.ts",
+      ],
+    },
+  },
   resolve: {
     alias: { "@": path.resolve(__dirname, "./src") },
   },