Prune unused and inert package references across the solution

[Vulthil]

Summary

• Vulthil.SharedKernel.Api now references Vulthil.Results directly instead of Vulthil.SharedKernel.Application, which it never used - consumers no longer pull FluentValidation/FluentValidation.DependencyInjectionExtensions in transitively. Semver-minor, release-note this.
• Removed all four unused references from the Npgsql provider (Microsoft.Extensions.Options.ConfigurationExtensions, Microsoft.Extensions.Diagnostics.HealthChecks, OpenTelemetry.Api, OpenTelemetry.Extensions.Hosting) and the unused Microsoft.Extensions.Options.ConfigurationExtensions from the Cosmos provider. None are used by provider code; the three former "version lift" references are dropped by maintainer policy - no pinning above a dependency's transitive floor without a concrete need. Consumers now resolve Aspire's own floors.
• Removed the unused Microsoft.Extensions.DependencyInjection.Abstractions reference from Vulthil.Messaging.Inbox.EntityFrameworkCore.
• Deleted 5 inert PackageVersion entries (and one now-orphaned version property) from Directory.Packages.props: Aspire.Hosting.JavaScript, Npgsql.EntityFrameworkCore.PostgreSQL, Microsoft.AspNetCore.Components.WebAssembly, Microsoft.AspNetCore.Components.WebAssembly.DevServer, Scalar.AspNetCore - none had a matching PackageReference anywhere in the repo.
• Removed the bundled Shouldly dependency from Vulthil.xUnit (unused by the package's own sources). Consumers relying on the transitive Shouldly reference from Vulthil.xUnit must add a direct Shouldly reference.
• Added PrivateAssets=all to the repo-wide SonarAnalyzer.CSharp reference - every shipped nupkg (verified against the live 1.1.0 nuspecs) listed the analyzer as a NuGet dependency, forcing consumers to restore it for nothing. Analyzer behavior in this repo is unchanged; the dependency simply stops flowing to consumers.
• Left Microsoft.Extensions.Options.DataAnnotations in Vulthil.Messaging.Inbox alone; it's genuinely in use today and its removal is coupled to a separate dead-code cleanup.

Verification

• Full solution build (Release): 0 warnings, 0 errors; the Npgsql provider re-built and re-packed after the reference removal (nuspec now lists only Aspire + EFCore + project references).
• dotnet pack -c Release before/after on all changed packages, diffed at the nuspec level to confirm exactly the intended dependency changes.
• Adjacent unit tests pass on both net9.0/net10.0: Api.Tests, Application.Tests, Infrastructure.Relational.Tests, Messaging.Inbox.Tests, Messaging.Inbox.Relational.Tests.
• Skipped container/Aspire-dependent suites (no Docker in the implementing environment): Vulthil.IntegrationTests, WebApi.Tests, MessagingIntegrationTests.

Backport to v1.0: no - dependency-graph changes ship with the next minor.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.