[OPER-QA-13] Contract tests Studio <-> Portico for the QA API surface

feature_id: FEAT-studio-qa-projects

## Context

Consumer-driven contract tests (Pact-style) between Portico's BFF (POR-QA-1) and Studio's QA API. Portico publishes a contract of what shape it expects from `GET /studio/portico/qa/inbox`, `POST /studio/portico/qa/runs`, etc. Studio's CI verifies its responses match.

Prevents the class of drift where Studio ships a breaking change and Portico only discovers it on tenant traffic.

## Acceptance Criteria

- `e2e/qa-contract-tests/*.pact.json` files committed from Portico's side describing expected request/response shapes
- Studio CI job `qa-contract-verify` runs Pact provider verification against the current Studio API on every PR touching `apps/web/src/app/api/studio/[team]/qa/**`
- Portico CI job `qa-contract-publish` (in portico repo) publishes updated contracts on merge to main
- First contracts covered: inbox list, single-task detail, run start, run complete, evidence upload
- Verification includes 4xx paths (401, 403, 404, 422)