kernel: bbox/polygon geometry as a pydantic discriminated union (replaces Annotation.geometry: dict)

[JArmandoAnaya]

Context

The bootstrap left Annotation.geometry: dict. The wire format needs real types now:
exporters, the API contract and the TS generation all depend on it.

Deliverables

• Discriminated union on a type field: BboxGeometry {x, y, width, height},
  PolygonGeometry {points: [[x,y], ...]} (≥3 points, non-self-intersecting not
  validated in M1 — document), ClassificationGeometry {} (tag, no coordinates).
• Coordinates in the asset's native reference frame (pixels), floats, never normalized —
  documented in docstrings (exporter concern).
• The union is designed to extend (polyline, keypoints, 3D) without breaking the
  discriminator.

Acceptance criteria

• Serialization round-trip stable (JSON) for each variant
• AnnotationService validates geometry type against allowed_geometries via the union
  — satisfied at the model level: the discriminator values ARE GeometryType members, so the
  check is a direct membership test. Enforcement itself stays with kernel: AnnotationService — schema-validated writes (hard reject: unknown class, disallowed geometry, missing required attribute), provenance, UUID identity #7.
• Negative width/height and <3-point polygons rejected at model level

[JArmandoAnaya]

Done: Geometry discriminated union in kernel/domain/geometry.py (BboxGeometry, PolygonGeometry, ClassificationGeometry); Annotation.geometry is typed, no longer dict. PR #72.
Decisions: discriminator values are GeometryType members rather than parallel literals, so allowed_geometries checks need no translation layer; variants are frozen + extra="forbid" so cross-variant key smuggling is rejected; width/height use gt=0 (a zero-area box is as degenerate as a negative one); self-intersection explicitly unvalidated in M1.
Deferred: AC 2 is satisfied at the model level and proven by test — AnnotationService (#7) and allowed_geometries (#6) do not exist yet, and no service was created here.
Follow-ups: #73 — reconcile the hand-written TS mirror in annotator/src/core/types.ts ("classification" vs "classification_tag", flattened vs nested geometry).
Next: #3 — real SqliteMetadataStore, whose annotation row mapper can now be written against the real type.