refactor: sort imports + extract @cv/handlebars + service-locator pilot for PolicyRegistry
Three threads landed together: 1) Biome assist.organizeImports enabled; ran across the workspace. useImportType disabled globally because it breaks NestJS constructor-injection metadata (Nest needs the runtime class for DI; type-only imports erase to undefined). Per-package overrides cleaned up to point at apps/api (was apps/server, stale since CVG-38 rename) and to include packages/core, packages/handlers, packages/mail, packages/file-storage. 2) CVG-51 @cv/handlebars: hoisted createHandlebars() factory + helpers from cv-renderer to a new package. mail's HandlebarsTemplateService and cv-renderer's HandlebarsEngine both use it. Drops marked + dompurify from cv-renderer (now via @cv/handlebars). All 91 cv-renderer tests pass. 3) CVG-54 pilot: PolicyRegistry now uses @riotbyte-com/nest-service-locator's ServiceLocator + tagged services instead of hand-rolled DiscoveryService scan. @Policy() decorator now wraps the tag's decorator so existing call sites are unchanged. Verified end-to-end via docker compose: api boots clean, GraphQL responds, worker boots, schema generates.