feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare

Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team
credential sharing, with the moshcode-style auth stack ported and reskinned to
match logicsrc.com (light theme, Inter, green accent).

apps/pwa
- auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie
  sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow
  (/cli/authorize + /cli/token). Ported from the moshcode PWA.
- credshare API (/api/credshare/*): teams, members, invites, vaults, sealed
  grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key.
  Zero-knowledge: only ciphertext + sealed vault keys + public keys stored.
- teams dashboard, accept-invite, and settings (API keys) pages, server-rendered
  in the LogicSRC brand (lib/html.mjs).
- migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via
  TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev.
- trimmed moshcode-specific approvals/credits/push/deliver.

CLI
- `logicsrc login` now does browser loopback OAuth-PKCE against the app and
  stores an lsk_ token (email-OTP removed); --token for CI. Client repointed.

Distribution
- install.sh (served at logicsrc.com/install.sh) installs the CLI from the
  GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper.
- root build:cli builds only the CLI's workspace chain (skips web/api/next).

Cleanup
- removed the commandboard-api credshare backend (superseded by the PWA) and its
  Supabase/Turso stores + libsql dep; commandboard-api tests green (40).
- removed the Next.js /teams page (the PWA is the web UI now).

Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login
uploads identity keys, owner pushes an encrypted .env, teammate invited ->
accepted -> granted -> pulls the exact file. Server stores ciphertext only.
Full workspace build + tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/logicsrc-web/public/install.sh

@@ -0,0 +1,98 @@
+#!/bin/sh
+# LogicSRC — one-line installer for the `logicsrc` CLI (from the GitHub repo).
+#
+#   curl -fsSL https://logicsrc.com/install.sh | sh
+#
+# Subcommands:
+#   curl -fsSL https://logicsrc.com/install.sh | sh -s -- install     (default)
+#   curl -fsSL https://logicsrc.com/install.sh | sh -s -- update
+#   curl -fsSL https://logicsrc.com/install.sh | sh -s -- uninstall
+#
+# What it does:
+#   1. Detects OS (Linux/macOS — Windows: use WSL) and requires Node 18+.
+#   2. Fetches the repo tarball from GitHub into $LOGICSRC_HOME/src.
+#   3. `npm install` + `npm run build:cli` (builds only the CLI's workspaces).
+#   4. Drops a `logicsrc` wrapper on $HOME/.local/bin.
+#
+# Env overrides:
+#   LOGICSRC_HOME=/path        install dir     (default: $HOME/.logicsrc-cli)
+#   LOGICSRC_BIN=/path/dir     wrapper bin dir (default: $HOME/.local/bin)
+#   LOGICSRC_REF=branch|tag    git ref         (default: master)
+set -eu
+
+GH_REPO="profullstack/logicsrc"
+LOGICSRC_REF="${LOGICSRC_REF:-master}"
+TARBALL_URL="https://codeload.github.com/$GH_REPO/tar.gz/$LOGICSRC_REF"
+
+# --- operator identity (curl|sh may land with HOME/USER unset) ---
+_home() { if [ -n "${HOME:-}" ] && [ -d "$HOME" ]; then echo "$HOME"; else echo "${HOME:-/tmp}"; fi; }
+HOME="$(_home)"; export HOME
+LOGICSRC_HOME="${LOGICSRC_HOME:-$HOME/.logicsrc-cli}"
+LOGICSRC_BIN="${LOGICSRC_BIN:-$HOME/.local/bin}"
+SRC_DIR="$LOGICSRC_HOME/src"
+WRAPPER="$LOGICSRC_BIN/logicsrc"
+
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+  G=$(printf '\033[32m'); Y=$(printf '\033[33m'); B=$(printf '\033[34m'); R=$(printf '\033[31m'); X=$(printf '\033[0m')
+else G=''; Y=''; B=''; R=''; X=''; fi
+info() { printf '%s==>%s %s\n' "$B" "$X" "$*"; }
+ok()   { printf '%s ✓%s %s\n' "$G" "$X" "$*"; }
+warn() { printf '%s !%s %s\n' "$Y" "$X" "$*" >&2; }
+fail() { printf '%s ✗%s %s\n' "$R" "$X" "$*" >&2; exit 1; }
+
+need() { command -v "$1" >/dev/null 2>&1 || fail "missing '$1' — please install it and re-run."; }
+
+detect_os() {
+  case "$(uname -s)" in
+    Linux) : ;; Darwin) : ;;
+    *) fail "unsupported OS (Linux and macOS only — Windows: use WSL)";;
+  esac
+}
+
+check_node() {
+  need node
+  major="$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)"
+  [ "$major" -ge 18 ] 2>/dev/null || fail "Node 18+ required (found $(node -v 2>/dev/null || echo none)). Install from https://nodejs.org or via mise/nvm."
+  need npm
+}
+
+do_install() {
+  detect_os; check_node
+  need curl; need tar
+  info "fetching logicsrc@$LOGICSRC_REF from GitHub…"
+  mkdir -p "$SRC_DIR"
+  tmp="$(mktemp -d)"
+  curl -fsSL "$TARBALL_URL" | tar -xz -C "$tmp" --strip-components=1
+  rm -rf "$SRC_DIR"; mkdir -p "$(dirname "$SRC_DIR")"; mv "$tmp" "$SRC_DIR"
+  ok "downloaded to $SRC_DIR"
+
+  info "installing dependencies (this can take a minute)…"
+  ( cd "$SRC_DIR" && npm install --no-audit --no-fund --ignore-scripts >/dev/null 2>&1 ) || fail "npm install failed — run it by hand in $SRC_DIR"
+  info "building the CLI…"
+  ( cd "$SRC_DIR" && npm run build:cli >/dev/null 2>&1 ) || fail "build failed — run 'npm run build:cli' in $SRC_DIR"
+
+  mkdir -p "$LOGICSRC_BIN"
+  cat > "$WRAPPER" <<EOF
+#!/bin/sh
+exec node "$SRC_DIR/packages/cli/dist/index.js" "\$@"
+EOF
+  chmod +x "$WRAPPER"
+  ok "installed logicsrc → $WRAPPER"
+
+  case ":$PATH:" in
+    *":$LOGICSRC_BIN:"*) : ;;
+    *) warn "add $LOGICSRC_BIN to your PATH:  export PATH=\"$LOGICSRC_BIN:\$PATH\"";;
+  esac
+  printf '\n%s🔐 logicsrc installed.%s  Next:\n   logicsrc login\n   logicsrc teams push <team> prod --env .env\n\n' "$G" "$X"
+}
+
+do_uninstall() {
+  rm -f "$WRAPPER"; rm -rf "$LOGICSRC_HOME"
+  ok "removed logicsrc ($WRAPPER, $LOGICSRC_HOME)"
+}
+
+case "${1:-install}" in
+  install|update|upgrade) do_install ;;
+  remove|uninstall) do_uninstall ;;
+  *) fail "unknown command '$1' (install | update | uninstall)";;
+esac