test: add Pact consumer contract for astrolabe credentials status (ADR-029)

Introduce consumer-driven contract testing between nextcloud-mcp-server and the
astrolabe Nextcloud app, published to the homelab Pact Broker and verified in CI.

- pact-python dev dep + `contract` pytest marker
- tests/contract/test_astrolabe_credentials_consumer.py: consumer pact for the
  background-sync *status* call (provisioned -> has_background_access:true,
  sync_type:"app_password", integer provisioned_at; unprovisioned -> false/null)
- tests/contract/test_mcp_provider_verification.py: env-gated Verifier harness
  for this server's /api/v1/* provider role (provider-state handlers stubbed
  pending astrolabe's published pacts)
- .github/workflows/pact.yml: join tailnet -> publish pacts -> provider verify
  -> can-i-deploy; broker steps skip when PACT_BROKER is unset (forks)
- docs/ADR-029-pact-contract-testing.md

Fix astrolabe_client.get_background_sync_status: it previously read a
non-existent `app_password` field (always reporting no-access). Rewrite it to
read the real status contract (has_background_access / sync_type /
provisioned_at) and drop the unsatisfiable get_user_app_password.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/contract/__init__.py

@@ -0,0 +1,12 @@
+"""Pact consumer/provider contract tests (ADR-029).
+
+This package contains the Pact contract tests that keep ``nextcloud-mcp-server``
+and the ``astrolabe`` Nextcloud app wire-compatible:
+
+- **Consumer** (this server -> astrolabe): ``test_astrolabe_credentials_consumer``
+  generates a pact for the background-sync credentials API that the
+  ``AstrolabeClient`` consumes.
+- **Provider** (astrolabe -> this server): ``test_mcp_provider_verification``
+  verifies the ``/api/v1/*`` HTTP API this server exposes against pacts that
+  the astrolabe app publishes to the broker.
+"""