Shared libraries

• shared/models: Product, Offer, Slip, Cart, PolicyResult
• shared/crypto: Ed25519 JWS, RFC 8785, audit hash
• shared/policy: fifteen-rule evaluator (one code path)
• shared/risk: OTIF and carbon helpers

Both sides import these; they do not call each other over the network.