State what an engine has to do, once, for every engine

[tonytonycoder11]

The exit criterion for #52 is that the gRPC engine "passes the same client test suite as the REST
engine". That suite did not exist.

What existed were transport tests asserting HTTP bodies through Ktor's MockEngine — the right way to
pin a wire format, and the wrong way to compare two of them, since a gRPC engine cannot satisfy an
assertion about a JSON body by construction. The one protocol-agnostic file,
CollectionsIntegrationTest, built its client with the REST Kdrant(host, port) factory in its second
line.

What this adds. kdrant-testkit, a module that is not published, holding QdrantClientContract:
an abstract suite that takes a QdrantClient from its subclass, talks to a real Qdrant in Docker, and
asserts on what comes back. It never names a protocol. RestClientContractIntegrationTest is the whole
of the REST side.

Thirty tests where there were five:

Area	Covered
Collections	create, exists, describe, list, delete, named vectors, ensureCollection, update
Points	upsert from a list and from a flow, retrieve, count with and without a filter, delete by id and by filter, numeric and uuid ids
Search	nearest-first ordering, filters, payload and vector selectors, batch, groups
Scroll	paging without repeats, filtered, ordered
Payload	set, overwrite, delete keys, clear, indexes
Vectors	update and delete one named vector at a time
Batch	ordered batchUpdate, where a later operation sees an earlier one
Filters	the four clauses, and every matcher the DSL offers put to a server that has to understand it
Service	aliases, facets, both distance-matrix forms, health probes, cluster info, collection and storage snapshots
Failures	a missing collection reported as CollectionNotFound

Scope is what both engines can do. Qdrant's gRPC API has no telemetry, no metrics, no issues
endpoint, no snapshot transfer and no shard-scope snapshots. Those stay in the REST module's own tests
rather than being weakened here into something both sides can pass — a shared suite that quietly drops
what one side cannot do proves less than one that says where the line is.

Notes on the module. It carries no mavenPublishing block and is excluded from public-API
tracking; its only consumers are the two transport modules' test source sets. It lives in a main
source set because a test source set cannot be depended on across modules, so detekt's function-naming
rule gets the same exclusion there it already gives src/test.

The suite is skipped, not failed, without Docker, so it is CI that proves it: the qdrant-compat job
already runs --tests "*IntegrationTest*" against both Qdrant images.

Part of #52. Merge after #61.