feat(shared): extract client/server pure helpers into @jerapah-flow/shared

Share profile merge, workflow filename/path helpers, HTTP_METHODS (with OPTIONS), and isPlainObject so web and server stop drifting. Core script sandboxes keep local isPlainObject copies.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/server/profile-config.js

@@ -1,31 +1 @@
-/**
- * Shallow merge: step overlay keys replace profile defaults (including "").
- * Nested objects/arrays are replaced, not deep-merged.
- *
- * @param {unknown} profileConfig
- * @param {unknown} stepConfig
- * @returns {Record<string, unknown>}
- */
-export function mergeProfileConfig(profileConfig, stepConfig) {
-  const base =
-    profileConfig != null && typeof profileConfig === "object" && !Array.isArray(profileConfig)
-      ? { ...profileConfig }
-      : {};
-  if (stepConfig == null || typeof stepConfig !== "object" || Array.isArray(stepConfig)) {
-    return base;
-  }
-  return { ...base, ...stepConfig };
-}
-
-/**
- * @param {unknown} config
- * @returns {boolean}
- */
-export function configHasOverlay(config) {
-  return (
-    config != null &&
-    typeof config === "object" &&
-    !Array.isArray(config) &&
-    Object.keys(config).length > 0
-  );
-}
+export { mergeProfileConfig, configHasOverlay } from "@jerapah-flow/shared";