feat: Phase 3 — Declarative engine (config format, diff/plan, dependency graph)

[2000game]

Phase 3 — Declarative engine (config format, diff/plan, dependency graph). The heart of the Terraform-style behaviour.

Part of #1.

Scope

• Config format: TypeScript-as-code. Config as importable .ts files that register resource objects (campus({…}), group({…}), etc.) into a registry. Typed helpers for each resource kind.
• Diff/plan: compare config vs actual (via API) vs state → per-resource create / update / delete / no-op. Human-readable ct plan output (default, no changes).
• Dependency graph: resolve apply order — metadata (group_type, group_status, age_group, target_group, campus, relationship_type) → group → group_hierarchy → group_role → permission → dynamic_group. Delete in reverse.
• Drift detection: plan reports manually-changed or deleted managed resources; new unmanaged groups never produce drift.

Definition of done

• ct plan against an adopted structure shows an accurate, ordered diff with zero changes when config matches reality.
• Introducing a change in config produces the correct single planned action.
• Dependency ordering is unit-tested with a synthetic graph.

[2000game]

Done — merged in #11 (declarative engine) + #12 (group hierarchy). DoD met: ordered ct plan diff with zero changes when config matches reality (live-verified), a single config change yields a single planned action, dependency ordering is unit-tested (graph.test.ts), and drift detection reports only managed resources.