feat(web): SvelteKit PWA shell with login

Phase 0 scaffolding for the frontend: SvelteKit + adapter-static in SPA mode
(fallback index.html, ssr disabled in the root layout — no Node process in
production, Caddy serves build/ directly per docs/PLAN.md), a login page and
auth store backed by /api/v1/auth/{login,me,logout}, an installable-PWA shell
(hand-written manifest, iOS meta/safe-area handling, an install-onboarding
banner), and a Dockerfile whose only job is to produce a buildable /app/build
artifact for deploy/ to consume.

Service worker notes, since the wiring isn't obvious from the diff:

- injectManifest, not generateSW: the caching policy needs to say "never
  cache /api/*", which generateSW's declarative config can't express as
  precisely as hand-written Workbox routes can.
- Uses the base `vite-plugin-pwa` plugin, not `@vite-pwa/sveltekit`'s
  SvelteKit-specific wrapper. That wrapper's injectManifest build expects
  SvelteKit's own built-in src/service-worker.{js,ts} convention to have
  already transpiled the file — but that native build only permits importing
  SvelteKit's own three virtual modules and hard-rejects `workbox-*` imports,
  which our SW needs. The base plugin bundles src/service-worker.ts directly
  instead, which works. SvelteKit's native service-worker convention is
  explicitly disabled (`kit.files.serviceWorker` pointed at a path that
  doesn't exist) so the two builds can't collide and silently clobber each
  other's output — they do, if both are left enabled, and the failure mode is
  silent (the SW builds fine, just precaches nothing).
- workbox-core/precaching/routing/strategies had to be added as direct
  devDependencies even though workbox-build depends on them — pnpm doesn't
  hoist transitive deps into the top-level node_modules, so the SW bundle
  step couldn't resolve them otherwise.
- The SPA fallback index.html doesn't exist yet at service-worker-build time
  (adapter-static writes it after all Vite plugins finish), so it can't be
  glob-hashed into the precache manifest normally. It gets a synthetic
  manifest entry instead, revisioned by a per-build-invocation timestamp
  (see the swIndexRevision comment in vite.config.ts) so the cached shell
  still invalidates correctly on every deploy.

Full rationale for each choice is inline as comments in vite.config.ts and
apps/web/README.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/src/routes/+page.svelte

@@ -0,0 +1,75 @@
+<script lang="ts">
+	import { goto } from '$app/navigation';
+	import { resolve } from '$app/paths';
+	import { auth } from '$lib/stores/auth';
+
+	$effect(() => {
+		if ($auth.status === 'unauthenticated') {
+			goto(resolve('/login'));
+		}
+	});
+</script>
+
+{#if $auth.status === 'authenticated'}
+	<main class="dashboard">
+		<div class="header-row">
+			<h1>Velodrome</h1>
+			<button
+				type="button"
+				class="logout"
+				onclick={async () => {
+					await auth.logout();
+					goto(resolve('/login'));
+				}}
+			>
+				Log out
+			</button>
+		</div>
+		<p class="signed-in-as">Signed in as {$auth.user.email}</p>
+		<p class="empty-state">No rides yet.</p>
+	</main>
+{:else if $auth.status === 'unknown'}
+	<main class="dashboard" aria-busy="true">
+		<p>Loading…</p>
+	</main>
+{/if}
+
+<style>
+	.dashboard {
+		max-width: 32rem;
+		margin: 0 auto;
+		padding: 2rem 1rem;
+	}
+
+	.header-row {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		gap: 1rem;
+	}
+
+	h1 {
+		margin: 0 0 0.25rem;
+		font-size: 1.75rem;
+	}
+
+	.logout {
+		border: 1px solid var(--color-border);
+		background: transparent;
+		color: var(--color-text-muted);
+		border-radius: 0.4rem;
+		padding: 0.35rem 0.7rem;
+		font-size: 0.8rem;
+		cursor: pointer;
+	}
+
+	.signed-in-as {
+		margin: 0 0 2rem;
+		color: var(--color-text-muted);
+		font-size: 0.85rem;
+	}
+
+	.empty-state {
+		color: var(--color-text-muted);
+	}
+</style>