D-30: extract Portico BFF pattern into @operant/qa-bff

---
feature_id: FEAT-studio-qa-projects
---

> D-30 ticket 2: extract @operant/qa-bff from Portico. Target FEAT-studio-qa-bff-pattern (child).

## Context

(PDT decision-memo lineage; see source line below.)

**Source: PDT D-30 (Studio QA external product surface), ticket 2 of 3.**

## What
Extract Portico's `apps/platform/src/lib/qa/{studio-writer,phi-guard,evidence-storage}.ts` pattern into a new package `@operant/qa-bff`. Any host product installs the package to get the pointer-only, PHI-safe writeback contract for free.

Package location: `packages/qa-bff/` in `operant-health/operant-studio` monorepo.

Portico migrates from hand-rolled to `@operant/qa-bff` in a follow-up POR-* ticket (not scoped here).

## Acceptance Criteria
- [ ] `packages/qa-bff/` package exists with the three modules
- [ ] Exports typed helpers: `createStudioWriter`, `withPhiGuard`, `storeEvidencePointer`
- [ ] Unit tests migrated from Portico's `apps/platform/src/lib/qa/__tests__/`
- [ ] Package builds and publishes cleanly under the D-30 ticket 3 pipeline

## Feature
FEAT-studio-qa-bff-pattern (add via feature-map + depmap two-PR sequence FIRST)

## Blocked-by
Dispatches in parallel with ticket 1.

## Size / Band
SMALL / assurance.