Adopt @civfix/shared 0.58.0

[theobong]

What changed

Moves services/api and services/media-worker from @civfix/shared ^0.57.0 to ^0.58.0, the campaign contract release from civfix/civfix-app#54.

Before you start

• Draft: this waits for the publish. 0.58.0 is published when Contract release: @civfix/shared 0.58.0 civfix-app#54 (and the stack below it) merges into main. Until then the lockfile cannot resolve it, so this PR carries only the two manifest ranges, and CI's frozen install fails by design.
• After the publish: the lockfile is refreshed (pnpm install), committed with the manifests, and the PR is marked ready.
• Where: staging (api.civfix.dev) after the main merge.

Verify

1. After the staging deploy, open https://api.civfix.dev/readyz. Expect: ready.
2. On civfix.dev, sign in, open the map, file a report with a photo, open an event and register, and open "Messages". Expect: everything works as before; no error toasts.
3. In the host console, open an event's "Analytics" and "Check-in". Expect: the same numbers and check-in results as before.

Regression

Calendar file: [Web]

1. On an event, choose "Add to calendar". Expect: the same file as before (the backend's ICS output is byte-identical under 0.58.0).

Decisions for the reviewer

• No backend code change is needed: no removed export is imported by services/api or services/media-worker (checked on main and the open backend PRs).
• Behaviour changes that reach the backend through the package: the typed client and AppError subclass fixes, and the lowercase score cursor. The backend already lowercases the cursor, so its normalizeScoreCursor can go later.
• New optional contract fields (admin DTOs, flag requests, the walk-up idempotencyKey, JobHandlerArg retry info) are listed in the campaign handoff with their order.
  • Strict request fields must be implemented before any client sends them.
  • New strict response fields must not be emitted until admin has adopted them.
• Follow-ups for the backend train, not in this PR:
  • adopt the shared isErrorCode, isUuid, time units, stripTrailingSlashes and ADMIN_REPORT_STATUS_BUCKETS;
  • pass onError from map.routes.

Not covered

• CI and staging run only after the publish and the lockfile refresh.

🤖 Generated with Claude Code