feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare

Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team
credential sharing, with the moshcode-style auth stack ported and reskinned to
match logicsrc.com (light theme, Inter, green accent).

apps/pwa
- auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie
  sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow
  (/cli/authorize + /cli/token). Ported from the moshcode PWA.
- credshare API (/api/credshare/*): teams, members, invites, vaults, sealed
  grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key.
  Zero-knowledge: only ciphertext + sealed vault keys + public keys stored.
- teams dashboard, accept-invite, and settings (API keys) pages, server-rendered
  in the LogicSRC brand (lib/html.mjs).
- migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via
  TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev.
- trimmed moshcode-specific approvals/credits/push/deliver.

CLI
- `logicsrc login` now does browser loopback OAuth-PKCE against the app and
  stores an lsk_ token (email-OTP removed); --token for CI. Client repointed.

Distribution
- install.sh (served at logicsrc.com/install.sh) installs the CLI from the
  GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper.
- root build:cli builds only the CLI's workspace chain (skips web/api/next).

Cleanup
- removed the commandboard-api credshare backend (superseded by the PWA) and its
  Supabase/Turso stores + libsql dep; commandboard-api tests green (40).
- removed the Next.js /teams page (the PWA is the web UI now).

Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login
uploads identity keys, owner pushes an encrypted .env, teammate invited ->
accepted -> granted -> pulls the exact file. Server stores ciphertext only.
Full workspace build + tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/logicsrc-web/src/app/teams/accept/page.tsx

@@ -1,25 +0,0 @@
-import type { ReactNode } from "react";
-import type { Metadata } from "next";
-import { SiteShell } from "@/components/site-shell";
-import { TeamsClient } from "@/components/teams-client";
-
-export const metadata: Metadata = {
-  title: "Accept invite · LogicSRC Teams",
-  description: "Accept a LogicSRC credential-sharing team invite.",
-  robots: { index: false },
-};
-
-// Invite emails link here as /teams/accept?token=… — log in, then the token is
-// auto-accepted by the client.
-export default async function AcceptInvitePage({
-  searchParams,
-}: {
-  searchParams: Promise<{ token?: string }>;
-}): Promise<ReactNode> {
-  const { token } = await searchParams;
-  return (
-    <SiteShell active="Credentials">
-      <TeamsClient initialToken={token} />
-    </SiteShell>
-  );
-}

apps/logicsrc-web/src/app/teams/page.tsx

@@ -1,19 +0,0 @@
-import type { ReactNode } from "react";
-import type { Metadata } from "next";
-import { SiteShell } from "@/components/site-shell";
-import { TeamsClient } from "@/components/teams-client";
-
-export const metadata: Metadata = {
-  title: "Teams · Credential Sharing · LogicSRC",
-  description:
-    "Manage credential-sharing teams and invites. Share secrets with teammates by email — end-to-end encrypted, so the server never sees plaintext. Decryption happens only in the logicsrc CLI.",
-  alternates: { canonical: "/teams" },
-};
-
-export default function TeamsPage(): ReactNode {
-  return (
-    <SiteShell active="Credentials">
-      <TeamsClient />
-    </SiteShell>
-  );
-}