feat(core,react): add the customer recommendation client

[TaprootFreak]

Step 2 of #198: move the customer-facing recommendation contract into the packages.

Changes

@dfx.swiss/core

• RecommendationUrl (recommendation, recommendation/:id/confirm, recommendation/:id/reject)
• Recommendation, CreateRecommendation, RecommendationStatus, RecommendationType,
  RecommendationMethod
• RecommendationApi with list, create, confirm, reject, wired into DfxApiClient as
  client.recommendation

@dfx.swiss/react

• useRecommendation() with getRecommendations, createRecommendation, confirmRecommendation,
  rejectRecommendation
• Re-exports of the new types

Tests cover all four client methods (recommendation-api.test.ts).

Notes

• expirationDate is optional. The API omits it for mail invitations (those do not expire), so
  modelling it as always present is wrong — a consumer that formats it unconditionally renders an
  invalid date for exactly that case. code is likewise absent once the code has been used.
• confirm and reject take an id, not the whole recommendation. Nothing but the id reaches the
  wire, and requiring a full object would force callers to keep one around just to decline.
• Both calls return an empty body. They resolve to void; re-read the list to observe the new
  status.
• Staff scope stays out. Only the account-scoped customer endpoints are covered here; the staff
  recommendation graph is not part of this contract.

Additive only — no existing export changes shape.

Version fields, changelogs and lockfile pins are untouched, per CONTRIBUTING.

[TaprootFreak]

Took 2 review passes to reach a clean run.

The first pass flagged one thing: RecommendationInterface was re-exported from the react package
root, which none of the other hooks do — the hook function is exported, the interface is not. Fixed in
fix(react): keep the hook interface out of the package root. Consumers that need the type can reach
it with ReturnType<typeof useRecommendation>.