feat(server): add authoritative game session per room (P4.5)

Each room owns a ChessEngine wrapped in a GameSession; only the server
calls insert/retract/fireRules and all EntityIds are minted server-side.
GameSessionRegistry keys sessions by room code so two rooms cannot
observe or collide with each other's working-memory state.

GameSession.applyMove validates algebraic inputs, finds the matching
legal move via ChessEngine.findMove, applies it, and returns a fact-
level diff (inserted/retracted) plus the new turn and terminal state.
Terminal states are sticky: further moves after checkmate/draw return
GAME_OVER rather than silently mutating a dead session.

Exposes @paratype/chess's headless surface (ChessEngine, coord helpers,
schema types) via a new package entry point; the React app continues to
import concrete modules directly.

packages/chess/src/index.ts

@@ -1,2 +1,31 @@
-// @paratype/chess — browser chess game
-export {};
+// @paratype/chess — public package entry.
+//
+// Re-exports the headless engine surface consumed by the authoritative
+// WebSocket server (see @paratype/chess-server). The React app imports
+// concrete modules directly; this barrel intentionally excludes anything
+// that pulls in DOM/React so that server consumers stay pure Node/Bun.
+
+export { ChessEngine, type GameResult } from "./engine.js";
+export {
+  algebraicToSquare,
+  squareToAlgebraic,
+  fileOf,
+  rankOf,
+  squareOf,
+  isOnBoard,
+  isValidSquare,
+} from "./coord.js";
+export {
+  GAME_ENTITY,
+  PROMOTION_PIECES,
+  oppositeColor,
+  chessFact,
+  type PieceType,
+  type PieceColor,
+  type Square,
+  type GameStatus,
+  type ChessAttrMap,
+  type ChessAttrKey,
+  type ChessFact,
+} from "./schema.js";
+export type { LegalMove } from "./rules/types.js";