[F0] Scaffold React/Vite web client with auth wired to the API

[mforce]

Closes #20. First frontend for Cluckwork — the scaffold was backend-only.

What

React 19 + Vite 6 + TypeScript SPA in web/, consuming the existing JSON API. Auth is wired to the real API (no mock): login/refresh/logout hit /api/v1/auth.

• Dev proxy (vite.config.ts): forwards /api/* to the backend (VITE_API_TARGET, default :8080), so the SPA is same-origin — the API needs no CORS for local dev.
• api/client.ts: typed fetch wrapper, bearer auth, single-flight refresh-and-retry on 401; drops the session and bounces to /login when refresh fails.
• auth/: localStorage token store, AuthContext, useAuth.
• routes/: Login (real POST /auth/login), ProtectedRoute guard, AppLayout shell (nav + sign-out), Dashboard, and placeholders for the daily-entry / stock / sales screens ([F1] Daily-entry capture screen (by grade) #21/[F2] Stock-by-grade view #22/[F3] Customers + sales order flow #23).

Verification

npm run build (tsc -b + vite build) passes clean — 50 modules, strict TS, 0 errors.

Follow-up dependency

End-to-end login needs a user to sign in with. There is no seeded user and migrations are not applied on startup. That scope was folded into #5 (startup migrate + seed default farm/house/admin user). Until #5 lands, log in via Swagger / the integration-test seed path.

Contract used

POST /api/v1/auth/login    {email,password}  -> {accessToken,refreshToken,expiresAt}
POST /api/v1/auth/refresh  {refreshToken}    -> {same}
POST /api/v1/auth/logout   {refreshToken}    -> 204

---

Migrated from Gitea PR #26 (https://gitea.mforcelabs.com/mforce/cluckwork/pulls/26).