test(02-01): add failing serialization test for MeResponse DTO

RED phase of TDD task 02-01-01. Locks the wire-format contract for
GET /api/v1/me before the DTO exists:

- camelCase JSON keys (id, sub, email, displayName) per D-27
- ignoreUnknownKeys forward compat for Phase 3 householdId per D-28
- MeResponse.toUser() one-to-one mapping

Wires kotlinx.serialization into shared/build.gradle.kts (api scope so
both client and server inherit the @Serializable runtime) and adds the
kotlinx-serializationJson catalog alias. The shared module remains
pure: only kotlin stdlib + kotlinx.serialization-json are pulled into
commonMain (D-19 / INFRA-06 still holds).

Test currently fails: MeResponse and User unresolved; GREEN follows.

shared/build.gradle.kts

@@ -3,6 +3,7 @@ plugins {
     // which requires the Android Gradle Plugin to already be on the project.
     alias(libs.plugins.androidLibrary)
     id("recipe.kotlin.multiplatform")
+    alias(libs.plugins.kotlinSerialization)
     id("recipe.quality")
 }
 
@@ -15,8 +16,12 @@ kotlin {
 
     sourceSets {
         commonMain.dependencies {
-            // Phase 1: intentionally empty. Domain models + DTOs land Phase 2+.
-            // D-19 / INFRA-06: No Ktor, Compose, SQLDelight, Koin, or Kermit here — EVER.
+            // Phase 2: DTOs land here (MeResponse/User per D-27). kotlinx.serialization
+            // is the only allowed runtime dependency in shared/commonMain — D-19 / INFRA-06
+            // forbids Ktor, Compose, SQLDelight, Koin, Kermit. `api(...)` so consumers
+            // (composeApp, server) inherit the @Serializable runtime without each
+            // re-declaring it.
+            api(libs.kotlinx.serializationJson)
         }
     }
 }