perf(bundle): keep zod out of the documents and Coach client routes

Both routes reached the schema library through a constant: the list of
document kinds, the list and bulk limits, the attachment cap, the Coach
data clusters and preference defaults, the conversation title length,
the scope source list and the report leaf order. Each sat in a schema
module, so importing the number shipped the library. The constants now
live in zod-free modules (lib/documents/inbound-constants,
lib/ai/coach/prefs-constants, lib/ai/coach/scope-sources,
lib/report-selection/catalogue) and the schema modules re-export them
for server code; the Coach page checks its scope parameter against the
closed list instead of parsing it. A guard walks each route's static
client graph with the TypeScript parser and fails on a zod import.

Two guards follow earlier commits in this branch: the fetch-limit
allowlist names the shared document picker sheet, and the card density
test states a floor on the cards it finds.

src/components/ui/__tests__/card-density.test.tsx

@@ -44,5 +44,13 @@ describe("compact density is the prop, not a class list", () => {
         ),
       );
     expect(hits).toEqual([]);
+    // The prop is where the compact cards went; a walk that finds none of
+    // them read the wrong tree.
+    const users = walkSourceFiles(src, { floor: 2500 }).filter(
+      (p) =>
+        p.endsWith(".tsx") &&
+        readFileSync(join(src, p), "utf8").includes('density="compact"'),
+    );
+    expect(users.length).toBeGreaterThanOrEqual(20);
   });
 });