feat(cli): port ssl-enforcement to native TypeScript

[Coly010]

Replaces the Phase-0 Go-binary proxies for supabase ssl-enforcement get and supabase ssl-enforcement update with native Effect handlers. Output, error messages, exit codes, and filesystem side effects are byte-identical to the Go CLI.

What changed

• ssl-enforcement get / update are now native TS — both handlers call the typed Management API client directly, with withCommandInstrumentation + withJsonErrorHandling middleware, and honour all five Go --output {pretty,json,yaml,toml,env} encoders as well as the TS --output-format {text,json,stream-json}.
• Hoist refactor: three artifacts move from apps/cli/src/legacy/commands/backups/ to a new apps/cli/src/legacy/shared/ directory because they are now reused across command families:
  • legacyManagementApiRuntimeLayer (was legacyBackupsRuntimeLayer)
  • mapLegacyHttpError (was mapLegacyBackupHttpError) — generic over the network/status error class pair
  • Go-compatible encodeGoJson / encodeYaml / encodeToml / encodeEnv — encodeGoJson now takes an optional nullForEmptyArrays option so backups can preserve its PITR-only "backups": null shape while ssl-enforcement omits it
• Backups list/restore call sites are refactored in the same change to use the hoisted shared modules. No behaviour change for backups.

Reviewer-relevant context

• The update handler validates the mutually-exclusive --enable-db-ssl-enforcement / --disable-db-ssl-enforcement flags at handler entry — Effect CLI has no cobra-equivalent MarkFlagsMutuallyExclusive. Validation error messages are verbatim cobra strings for parity with the Go binary.
• Effect.ensuring nesting in both handlers mirrors Go's PersistentPostRun: telemetryState.flush wraps the entire body (so it flushes even on ref-resolution failure), while linkedProjectCache.cache(ref) only wraps the post-resolution sub-effect (it requires a resolved ref).
• The SSL-enforcement SIDE_EFFECTS.md files were previously stubs with wrong API paths (/v1/projects/{ref}/config/ssl-enforcement) and wrong response shapes ({enforced, override_enabled}). Both are rewritten with the correct path (/v1/projects/{ref}/ssl-enforcement) and response ({currentConfig: {database}, appliedSuccessfully}).
• encodeEnv was hardened to escape \n / \r / \t (Go %q parity). Latent bug — boolean-only ssl-enforcement schema never triggered it, but fixing it now in the shared encoder prevents future ported commands with string fields from injecting newlines into env output that a downstream eval / source would treat as separate KEY=VALUE assignments.
• docs/go-cli-porting-status.md flips both ssl-enforcement rows from wrapped to ported.

Closes CLI-1297