feat(web): TanStack Start app skeleton with SSR and gate wiring

[ByteMeBaby]

What

Stands up apps/web as a TanStack Start (React) app that server-renders a placeholder home page and hydrates it on the client, replacing the prior library-style stub. It is the booting frontend shell; later chunks attach the UI kit, a typed API client, theming, and auth to the same app.

Changes

• Routing: file-based routes under apps/web/src/routes; the root route renders the document shell and owns the top-level error boundary and 404. Page components live outside route files (so routes stay code-split); the / route registers HomePage from src/components.
• Generated route tree: src/routeTree.gen.ts is generated and gitignored — the Start plugin regenerates it on vite build, and tsr generate runs before typecheck. Never committed; rebuilds from a clean checkout.
• Gate adaptation for a Vite app: vite build produces dist/client + dist/server; Vitest runs on jsdom with Testing Library; web-specific tsconfig overrides (jsx, DOM libs, bundler resolution).
• Lint: the shared ESLint config now matches .tsx, so no-explicit-any and @forgekit/dependency-flow apply to React files.
• Dependency edge: the home page renders UI_VERSION from @forgekit/ui (the only internal import web is allowed), keeping the Turborepo build edge real.
• Doc: docs/web/app-skeleton.md.

Verification

• All four gates green from a clean checkout with cache forced off (build, lint, typecheck, test).
• Route tree regenerates from a deleted state — no reliance on a committed generated file.
• Booted in headless Chromium: SSR renders the placeholder and the client hydrates cleanly — 0 console errors, 0 hydration mismatches, client module graph loads.
• dist/server is not nested under the client's served directory.

Deferred (intentional)

• react-hooks ESLint plugin lands with the next chunk's first hook — no hooks exist yet, and enforcement travels with the code it guards.
• tsconfig layout left as-is to keep parity with sibling packages.