Extract a build-logic convention plugin to collapse duplicated plugin build boilerplate

~350 lines of toolchain/repos/processResources/test/shadow/jar-disable/copyPlugin boilerplate were duplicated across the four Paper-plugin builds and drifting (AUDIT.md §2 MED, finding #9).

Done: a build-logic included build (wired via pluginManagement { includeBuild("build-logic") }) with two precompiled Kotlin-DSL convention plugins:

• io.paradaux.jvm-conventions — applied by all 4 (treasury, business, treasury-api-plugin, chestshop): Java toolchain 21 + JavaCompile UTF-8/release 21.
• io.paradaux.paper-server-conventions — applied by the 3 shading server plugins; applies jvm-conventions transitively and adds the common repositories (gated mavenLocal, PAR-267), processResources expansion, base test setup, shaded-jar defaults, and copyPlugin staging+prune (PAR-268). Shadow config deferred via plugins.withId("com.gradleup.shadow") so it's order-independent.

Per-project specifics stay in each build: relocations, jacoco gates/excludes, dependencies, flyway test staging, publishing. ChestShop keeps its bespoke repos/shadow/resources and applies only jvm-conventions. build-logic pinned to JDK 21 (Gradle's toolchain auto-detect otherwise picked a JRE with no compiler).

Net ~318 lines removed from the four build files. Verified: all 4 compile + shade; business 95% coverage gate passes; release task + copyPlugin staging/prune work via the convention. (Treasury IT suite hit the documented MariaDB4j-on-Windows EOFException flakiness locally — environmental, validated against real MariaDB in CI; treasury's jacoco config is unchanged by this refactor.)