feat(engine): failure model + foundational detection rules

[sepehr-safari]

What & why

First slice of S2 — Detection + conformance: the failure-detection layer and
its foundational rule batch. Mirrors the toolkit's core/detection.ts — the
shared conformance contract — so the two implementations flag the same failures.

Changes

• Failure model (types.zig, deferred here from S1) — FailureSeverity, the
  full 16-code FailureCode taxonomy with wire-string encoding, and Failure
  (code / description / severity / event_ids / suggested_steps).
• src/ocpp/detection.zig — the detectFailures(arena, events, sessions)
  orchestrator (runs rules in contract order), the per-code severity and
  remediation-step metadata tables (the full taxonomy, defined once), and shared
  payload-extraction helpers.
• Foundational rules — contract rules 1–3:
  • FAILED_AUTHORIZATION — Authorize response with idTagInfo.status = "Invalid".
  • CONNECTOR_FAULT — Faulted StatusNotification during an active transaction.
  • STATION_OFFLINE_DURING_SESSION — a transaction that starts but never stops,
    or an Unavailable / Offline status mid-session.

Scope boundaries

detectFailures grows across the next two rule batches (#20, #21). The
conformance harness over the 15 shared scenarios lands in the close-out (#22).
Detection is measured on the de-duplicated, sorted set of FailureCodes.

Testing

• native test -Dplatform=null → 37/37 pass (4 new: the failure-taxonomy
  encoding, plus each rule fires on its trigger and stays silent otherwise —
  driven through the real parse → correlate → detect pipeline).
• native check --strict and zig fmt --check clean.

Closes #19