web: shell, theme, keyboard, stub routes, palette skeleton

- lib/theme.ts: bootstrapTheme() + setTheme() with OS/localStorage sync
- lib/keyboard.ts: g-prefix nav, j/k cursor, ⌘K palette, Esc, Enter
- lib/theme.test.ts + lib/keyboard.test.ts: 26 vitest tests (TDD)
- shell/TopBar.tsx: brand crumb, search trigger, tab nav using router pathname
- shell/SubBar.tsx: slot component with optional right section
- shell/Palette.tsx: modal overlay, JUMP items, synthetic SEARCH row
- styles/shell.css + styles/palette.css: ported verbatim from prototype.css
- routes/__root.tsx: wires TopBar, Outlet, Palette, keyboard controller, bootstrapTheme
- routes/index.tsx + projects/stats/health/settings/search.tsx: EmptyState stubs
- main.tsx: replace scaffold div with RouterProvider
- vitest.config.ts: add jsdom url for localStorage support (Node 25 compat)

web: scaffold vite/react/ts project, port design tokens and primitives

- package.json with runtime (react, tanstack-query, tanstack-router) and
  dev deps (vite, typescript, vitest, eslint, prettier, testing-library)
- vite.config.ts: @vitejs/plugin-react + TanStack Router file-based plugin;
  dev proxy for /api/v1, /healthz, /readyz, /metrics with Remote-User header;
  build.outDir set to ../internal/server/web/dist (Go embed target)
- tsconfig.json (strict, ES2022, react-jsx, bundler resolution) + tsconfig.node.json
- .eslintrc.cjs (eslint 8 + @typescript-eslint + react-hooks), .prettierrc (single quotes, no semis)
- index.html: Inter + JetBrains Mono fonts, body.density-compact, #root mount
- src/main.tsx: React root with QueryClientProvider, temporary scaffold div
- src/styles/tokens.css: verbatim :root and [data-theme="dark"] blocks from prototype.css
- src/styles/primitives.css: .tag, .tooldot, .spark, .statusdot, .empty, .sub rules
- src/primitives/{Tag,ToolDot,Spark,StatusDot,EmptyState,Sub}.tsx with typed signatures
- src/primitives/index.ts re-exports all primitives
- web/.gitignore: node_modules/, coverage/
- root .gitignore: web/node_modules/, internal/server/web/dist/* with .gitkeep exception
- vitest.config.ts separate from vite to avoid router plugin scan error on empty routes dir
- src/routes/__root.tsx minimal root route to satisfy TanStack Router plugin at build time