feat(core): session handshake + PactoSession

[jean1222312432]

Summary

• Add Gateway checkout session handshake: CheckoutSession model, HMAC-bound clientSecret, POST /v1/session and POST /v1/session/refresh, with typed session errors (session_invalid / session_expired).
• Extend @pacto-connect/core with createCheckoutSession, PactoSession (expiration + refresh), and typed PactoSessionError / PactoError.
• Re-export new session types from @pacto-connect/react.

Closes #12

Test plan

• npm run lint
• npm run type-check
• npm run test
• Run prisma migrate deploy on Gateway DB for CheckoutSession
• Manual: create session with publishable key + allowed Origin, refresh, confirm expired/invalid secrets return typed errors