Add the @plone/controlpanels package with the content types driver

[sneridagh]

Phase 0 of #269 (content types control panel). Stacked on #263.

What

A new package, @plone/controlpanels, for control panel screens that run unchanged in Plone Aurora and in Volto. This PR adds no screens yet, only what they will be built on:

• Data model (src/content-types/types.ts): what the screens show and edit, including type settings, schema, behaviors, workflows, workflow change previews and jobs, and site defaults. It's independent of any backend payload.
• ContentTypesDriver (src/content-types/driver.tsx): the interface every app implements to read and write that data. In Aurora that's resource routes and @plone/client; in Volto it will be redux; stories and tests use the mock. The driver's capabilities say what its backend supports, so the screens can ship against today's plone.restapi and turn features on as [DRAFT] Endpoints for per-type content settings, behavior order and workflow assignment plone.restapi#2061 lands. Optional methods exist only when their capability is on.
• createMockDriver(): an in-memory driver seeded with fixtures captured from the acceptance backend (Plone 6.2 + plone.volto), completed by hand where plone.restapi has no data yet (per-type settings, behavior order, workflows, state counts). Each behavior's fields come from its own schema (captured from scratch types with every behavior enabled), and an add-on behavior (collective.sponsors) stands for behaviors the frontend knows nothing about. Folder is left out, since plone.volto replaces folders with folderish pages. It covers every method, including workflow changes run as jobs, plus options for latency and turning capabilities off.
• suggestStateMapping(): the workflow change suggestion from the design. It keeps who can see an item and never makes content more visible. Unlike the classic panel, it maps Published to Externally visible instead of Internal draft.
• stateColor(): the color the UI shows a workflow state with, one of the six Quanta color families (gray, blue, teal, green, yellow, red). The first that applies wins: app overrides by state id, the color the backend sets on the state, defaults for Plone's core states (DEFAULT_STATE_COLORS), then a color derived from who can see items in the state, so custom workflows get a meaningful color too.
• ControlPanelsProvider: connects the screens to the app's router (through the react-aria-components RouterProvider), translations (translate, in react-intl's message shape so both Aurora and Volto can plug in) and notifications (notify).

Keeping it usable in Volto

• Allowed dependencies: react, react-aria-components, @plone/quanta, @plone/helpers, @plone/registry, jotai. React peers stay at 16.8–19.
• src/dependencies.test.ts fails when package.json or a source file uses anything else. ESLint's no-restricted-imports reports the usual offenders (react-router, i18n libraries, @plone/client, @plone/cmsui, @plone/components…) in the editor.
• Rules are written down in the package's AGENTS.md.

Also

• Like the other add-on packages, it ships its TypeScript source with no build step: Aurora (Vite) and Volto (Babel, automatic JSX runtime) compile it. The release groups and the package lists in the docs include it.
• Storybook is set up (pnpm --filter @plone/controlpanels storybook, port 6007), with an introduction page for now.

Not in this PR

• CSS for Volto: a precompiled controlpanels.css comes with the Volto port. quanta.css only ships tokens, not Tailwind utilities, so Volto needs the utilities compiled for it. Aurora compiles the package's classes from its source.

Checks

• pnpm --filter @plone/controlpanels test --run: 31 tests pass. I confirmed the dependency guard fails when react-router is imported.
• pnpm --filter @plone/controlpanels check:ts and build-storybook pass.