Epic: stable, modular foundation library (API promises + modularity)

[sorenwacker]

Tracking epic: make metaseed a stable, modular foundation library that other apps (e.g. metaseed-hub) build on by reusing its tools.

metaseed stays single-user. This is about two things, not multi-tenancy:

• Promises — a dependable public API consumers can build on without getting broken.
• Modularity — cleanly separable tools, so a consumer imports only what it needs.

Supersedes the earlier multi-user/enterprise framing — those sub-issues (#62 state, #63 database, #64 auth, #66 observability) were closed as out of scope.

Promises — a dependable public API

• Define, document and enforce the public API boundary #68 — Define, document and enforce the public API boundary (MetaseedClient + the tools consumers import; mark everything else internal).
• Adopt SemVer and a deprecation policy #69 — Adopt SemVer + a deprecation policy (deprecate-then-remove; never silently break a consumer).
• Contract tests against metaseed-hub (sole consumer) #70 — Contract tests against metaseed-hub (the sole consumer) so breaking changes fail CI before release.

Modularity — cleanly separable tools

• Audit dependency direction: decouple the reusable tools from the web app #71 — Audit dependency direction: core/tools must not import the web app; the tools must be importable without FastAPI/UI.
• Enterprise: CI/CD pipeline and supply-chain scanning #65 — CI/CD + supply chain: run the gates on every PR, publish the package, run the contract tests in CI.
• Integrations stay optional extras (metaseed[dcat] done; metaseed[seek] planned) — tracked in the integration epics (Add DCAT (Data Catalog Vocabulary) support #24, FAIRDOM-SEEK interoperability #33, Support for export of PRIDE submission file #21, MetaboLights submission export (ISA-Tab + MAF) #43).

The 260628 codebase review (docs/REVIEW.md) is the near-term reliability input; its findings are being worked separately.