cloud/C1: scaffold src/services/luminaCloud/

[blueberrycongee]

What

Scaffolds src/services/luminaCloud/ as an empty-but-typed module — the public surface (types, function signatures, barrel) is fixed up front so subsequent tasks (C2…C6) can land independently without churning imports across the codebase.

types.ts mirrors cloud/CONTRACT.md §1.1 (license payload), §2.4 (usage response), §6 (error shapes). It also adds the §2.1 verify response, §2.3 models, §2.5 revocations, plus a LicenseStatus derived type for the upcoming Zustand store.

PUBLIC_KEY.ts ships an obviously-fake AAA…= placeholder, marked // LEAD: replace with real public key from lumina-cloud T3 output. It is deliberately structured so that any accidental ship-to-prod fails verification immediately.

verify.ts, store.ts, revocations.ts, client.ts expose typed function signatures that throw not implemented yet (task Cn) until the corresponding tasks land.

index.ts is the barrel — re-exports the entire public surface.

Acceptance criteria

• types.ts mirrors cloud/CONTRACT.md §1.1 license payload + §2.4 usage response + §6 error shapes.
• index.ts re-exports the public surface.
• npm run typecheck passes.
• No new runtime dependencies yet (those come in C2).

How I tested

• npm run typecheck: pass (both tsconfig.json and tsconfig.node.json).
• npm test: skipped — C1 has no test files; nothing imports the new module yet, so existing tests are unaffected.

Touched files outside src/services/luminaCloud/

• cloud/TASKS.md — marked C1 [x] and appended Done-log entry. No other files outside cloud/PRD.md §3 surfaces touched.

Notes for Lead

• PUBLIC_KEY_B64 is a 32-byte all-zero placeholder. Replace from lumina-cloud T3 output before any real verification ships. C2 will use a fixture keypair so it does not block on T3.
• LicenseVerifyResponse is exported even though §2.1 is not on the C1 acceptance list — it costs nothing here and saves a follow-up edit when C5 lands.
• noUnusedParameters is on, so stub bodies use _param naming. When C2…C6 implement these, the leading underscore should be dropped along with the throw.

[blueberrycongee]

Closing in favor of clean re-issued PR — original branch had cumulative commits from prior tasks that don't apply to current main. Integrator will open a re-issued PR with just C1's specific changes.