feat(api): create routines

[rd-code-23]

What changed

• Added the shared request and response contracts for creating routines.
• Added POST /routines for authenticated users.
• Validated that every requested exercise is either built in or owned by the current user.
• Created the routine, its ordered exercises, and its optional schedule in one PostgreSQL transaction.
• Added a dedicated business error for unavailable exercise selections.
• Added contract, route, and service tests.

How it works

Routine creation spans three related tables: routines, routine_exercises, and routine_schedules. The service uses one database transaction so these writes behave as a single operation. If validation or any insert fails, PostgreSQL rolls everything back instead of leaving a partially created routine.

Before inserting anything, the service deduplicates the requested exercise IDs and queries only exercises available to the current user. Built-in exercises have no owner, while custom exercises must belong to that user.

Because exercise IDs are unique and the requested IDs were deduplicated, matching the number returned by the query to the number requested proves that every requested exercise was found and accessible.

The transaction callback is named currentTransaction to distinguish the active transaction object from the database.transaction(...) method that creates it.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test — 97 tests passed
• Prettier run on all eight changed files

The repository-wide format check still reports an existing Windows line-ending issue across unrelated files; this PR does not reformat those files.