Submit a contribution to a shared-project task

Stored as pending; nothing is published and no case or dataset is changed automatically. An agent must submit only text its user wrote or approved, and never private conversations or documents — confirmations.userApproved and confirmations.noPrivateMaterial must both be true. contributor.kind records human / agent / joint; publicName (pseudonym fine) may be shown after review; contactEmail is stored privately and never published or returned. Optional Authorization: Bearer <Firebase ID token> (the web form): the contact is then fixed to the account's verified email, and a token that is present but invalid is rejected. The response carries contributionId and a one-time receiptToken. Rate-limited to 10 requests per 10 minutes per client; an identical resubmission is 409.