server: define async Store protocol (#306)

[nissessenap]

Summary

Defines the async Store protocol that both SqliteStore (#308) and the eventual PostgresStore will conform to. Pure interface — no implementations, no runtime wiring. Part of #257 / RFC #275, Phase 1 step (3).

Changes

• Added server/backend/src/cq_server/store/_protocol.py — Store(typing.Protocol) with async def signatures covering every public method on RemoteStore today.
• Moved store.py → store/__init__.py to make store a package (prep for Implement SqliteStore against Store protocol via Core helpers #308, which re-exports SqliteStore from the same package root). Pure rename: only change is .scoring/.tables → ..scoring/..tables relative-import fix.
• Re-exported Store from cq_server.store so callers don't reach into the private _protocol module.
• Added tests/test_store_protocol.py — structural TDD check that RemoteStore satisfies Store via @runtime_checkable + issubclass. The test docstring calls out the known limitation (runtime_checkable only checks attribute names, not sync-vs-async); once SqliteStore lands in Implement SqliteStore against Store protocol via Core helpers #308 the same test continues to pass against a genuinely async impl.

Scope deviation worth flagging

The issue said "No changes to existing `store.py`." The branch renames it to `store/init.py`. This is deliberate — #308 explicitly requires the `store/` package layout, and doing the move now avoids a churny second rename. Rename is behavior-preserving (99% similarity; only import paths adjusted).

Out of scope (intentionally deferred)

• No concrete implementation — lands in Implement SqliteStore against Store protocol via Core helpers #308.
• No tightening of `list[dict[str, Any]]` return types into `TypedDict`s. Matches current `RemoteStore` shapes per issue scope.
• No async context-manager methods on the protocol. `async def close()` is sufficient for now; `aenter`/`aexit` is a lifecycle decision that belongs to Implement SqliteStore against Store protocol via Core helpers #308 where the threadpool-shim question is live.

🤖 Generated with Claude Code

[nissessenap]

Small note about the current _protocol.
Should we tighten some of the returns from list[dict[str, Any]] to TypedDicts to make the interface a bit stricter?
I kept the current scope of not chaging anything in this PR.

ending_queue/list_units share a uniform shape, get_user is stable.

The API-key methods are trickier because create_api_key, get_api_key_for_user, get_api_key_by_hash, and list_api_keys_for_user, each project a different subset of columns (plus get_api_key_by_hash joins in username), so that needs a design call: one TypedDict with NotRequired fields, or separate types per method?
Similarly, recent_activity is a discriminated union on type.

[peteski22]

LGTM 🙏🏼