feat(shared): extract client/server pure helpers into @jerapah-flow/shared

Share profile merge, workflow filename/path helpers, HTTP_METHODS (with OPTIONS), and isPlainObject so web and server stop drifting. Core script sandboxes keep local isPlainObject copies.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/server/step-result.js

@@ -2,12 +2,9 @@
  * Step return contract: `{ output, context?, skipRemaining? }`.
  */
 
-/**
- * @param {unknown} value
- */
-export function isPlainObject(value) {
-  return value != null && typeof value === "object" && !Array.isArray(value);
-}
+import { isPlainObject } from "@jerapah-flow/shared";
+
+export { isPlainObject };
 
 /**
  * @param {unknown} value