Validate typed JSON filter paths before transport

[terjekv]

Summary

• add a shared JsonPath type that validates the Hubuum v0.0.9 JSON-path grammar
• preserve the existing fluent .path([...]).operator(...) API while carrying invalid paths to a local terminal-operation error
• preserve the existing root JSON operator methods for source compatibility, but reject their unsupported pathless filters before transport
• add try_path for eager validation and with_path for reusable validated paths
• reuse the same validation for object aggregate JSON paths while preserving ObjectAggregateJsonPath as a compatibility alias
• add async/blocking no-transport regressions and compile-time compatibility coverage

Behavior and compatibility

Invalid, empty, or missing JSON filter paths now return ApiError::InvalidJsonPath locally before any request is sent. Existing valid chains continue to compile unchanged:

client
    .classes()
    .json_schema()
    .path(["properties", "hostname"])
    .eq("string")

Callers that want immediate validation can use try_path(...)?; callers that reuse a path can construct JsonPath once and pass it to with_path.

Invalid aggregate paths now use the same ApiError::InvalidJsonPath variant. The old aggregate path type name remains available as an alias.

No breaking change. No dependency, MSRV, target-server, or OpenAPI snapshot changes are included.

Closes #68

Verification

• cargo fmt --all -- --check
• cargo run -p hubuum_reconcile --locked -- check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps
• cargo test --workspace --all-features --locked
• focused async/blocking invalid and missing-path no-transport tests after the compatibility correction
• trybuild coverage for the original root and fluent path APIs
• all five supported public feature combinations
• cargo +1.88 check --workspace --all-targets --all-features --locked
• python3 scripts/openapi-contract.py validate
• ./scripts/run-integration-tests.sh --with-e2e-client -- --test-threads=1 against the pinned server image