fix(12): CR-01 remove extraneous providerType from postSetupCredential wire body

The server's credentialSchema does not declare providerType; it was being
silently stripped by Zod. Remove it from the request body and add a
contract test suite asserting the exact wire keys sent, mirroring the
existing BUG-1 tests for postSetupConfig.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/pwa/src/api/client.ts

@@ -671,9 +671,9 @@ export async function postSetupCredential(payload: SetupCredentialPayload): Prom
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
-      providerType: 'caldav',
       fastmailEmail: payload.fastmailEmail,
       appPassword: payload.appPassword,
+      // providerType omitted — not in credentialSchema; server hard-codes 'caldav'
     }),
   });