feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare

Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team
credential sharing, with the moshcode-style auth stack ported and reskinned to
match logicsrc.com (light theme, Inter, green accent).

apps/pwa
- auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie
  sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow
  (/cli/authorize + /cli/token). Ported from the moshcode PWA.
- credshare API (/api/credshare/*): teams, members, invites, vaults, sealed
  grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key.
  Zero-knowledge: only ciphertext + sealed vault keys + public keys stored.
- teams dashboard, accept-invite, and settings (API keys) pages, server-rendered
  in the LogicSRC brand (lib/html.mjs).
- migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via
  TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev.
- trimmed moshcode-specific approvals/credits/push/deliver.

CLI
- `logicsrc login` now does browser loopback OAuth-PKCE against the app and
  stores an lsk_ token (email-OTP removed); --token for CI. Client repointed.

Distribution
- install.sh (served at logicsrc.com/install.sh) installs the CLI from the
  GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper.
- root build:cli builds only the CLI's workspace chain (skips web/api/next).

Cleanup
- removed the commandboard-api credshare backend (superseded by the PWA) and its
  Supabase/Turso stores + libsql dep; commandboard-api tests green (40).
- removed the Next.js /teams page (the PWA is the web UI now).

Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login
uploads identity keys, owner pushes an encrypted .env, teammate invited ->
accepted -> granted -> pulls the exact file. Server stores ciphertext only.
Full workspace build + tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/pwa/public/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="112" fill="#070806"/>
+  <rect x="96" y="96" width="320" height="320" rx="64" fill="#a6ff1a"/>
+  <text x="256" y="256" font-family="Helvetica,Arial,sans-serif" font-size="240" font-weight="800"
+        fill="#0a1400" text-anchor="middle" dominant-baseline="central">M</text>
+</svg>

apps/pwa/public/manifest.webmanifest

@@ -0,0 +1,15 @@
+{
+  "name": "LogicSRC Credentials",
+  "short_name": "LogicSRC",
+  "description": "Human-in-the-loop approvals for your moshscript loops.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#070806",
+  "theme_color": "#070806",
+  "icons": [
+    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any maskable" },
+    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png" },
+    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png" }
+  ]
+}

apps/pwa/public/passkey.js

@@ -0,0 +1,53 @@
+/* Passkey button: try to sign in with a discoverable passkey; if there's none,
+   register a new one. Uses the @simplewebauthn/browser UMD bundle (/vendor). */
+(function () {
+  var btn = document.getElementById("passkey-btn");
+  var msg = document.getElementById("passkey-msg");
+  if (!btn) return;
+
+  function csrf() {
+    var m = document.cookie.match(/(?:^|; )mc_csrf=([^;]+)/);
+    return m ? decodeURIComponent(m[1]) : "";
+  }
+  function post(url, body) {
+    return fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-csrf-token": csrf() },
+      body: JSON.stringify(body || {}),
+    });
+  }
+  function say(t) { if (msg) msg.textContent = t; }
+
+  async function register() {
+    say("creating a passkey…");
+    var opts = await (await post("/auth/passkey/register/options")).json();
+    var att = await SimpleWebAuthnBrowser.startRegistration({ optionsJSON: opts });
+    var r = await post("/auth/passkey/register/verify", att);
+    var out = await r.json();
+    if (out.ok) location.href = out.redirect || "/";
+    else say(out.error || "couldn't create passkey");
+  }
+
+  async function login() {
+    var opts = await (await post("/auth/passkey/login/options")).json();
+    var asr = await SimpleWebAuthnBrowser.startAuthentication({ optionsJSON: opts });
+    var r = await post("/auth/passkey/login/verify", asr);
+    var out = await r.json();
+    if (out.ok) { location.href = out.redirect || "/"; return true; }
+    throw new Error(out.error || "sign-in failed");
+  }
+
+  btn.addEventListener("click", async function () {
+    if (!window.PublicKeyCredential) { say("this device doesn't support passkeys"); return; }
+    btn.disabled = true;
+    try {
+      await login();
+    } catch (e) {
+      // no discoverable credential / user cancelled login → offer to register
+      try { await register(); }
+      catch (e2) { say(String(e2.message || e2)); }
+    } finally {
+      btn.disabled = false;
+    }
+  });
+})();

apps/pwa/public/sw.js

@@ -0,0 +1,55 @@
+/* LogicSRC PWA service worker — offline app shell (network-first for docs). */
+const CACHE = "logicsrc-v1";
+const SHELL = ["/", "/icon.svg", "/manifest.webmanifest", "/passkey.js"];
+
+self.addEventListener("install", (e) => {
+  e.waitUntil(caches.open(CACHE).then((c) => c.addAll(SHELL)).then(() => self.skipWaiting()));
+});
+
+self.addEventListener("activate", (e) => {
+  e.waitUntil(
+    caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k)))).then(() => self.clients.claim())
+  );
+});
+
+// approval push notifications
+self.addEventListener("push", (e) => {
+  let d = {};
+  try { d = e.data ? e.data.json() : {}; } catch (_) {}
+  e.waitUntil(self.registration.showNotification(d.title || "LogicSRC", {
+    body: d.body || "You have an approval waiting.",
+    icon: "/icon.svg",
+    badge: "/icon.svg",
+    data: { url: d.url || "/" },
+    tag: "logicsrc",
+  }));
+});
+
+self.addEventListener("notificationclick", (e) => {
+  e.notification.close();
+  const url = (e.notification.data && e.notification.data.url) || "/";
+  e.waitUntil(clients.matchAll({ type: "window" }).then((cs) => {
+    for (const c of cs) if ("focus" in c) { c.navigate(url); return c.focus(); }
+    return clients.openWindow(url);
+  }));
+});
+
+self.addEventListener("fetch", (e) => {
+  const { request } = e;
+  if (request.method !== "GET") return; // never cache POSTs / API writes
+  const url = new URL(request.url);
+  if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/auth/") || url.pathname.startsWith("/webhooks/")) return;
+
+  // network-first, fall back to cache (so approvals stay fresh, offline still loads a shell)
+  e.respondWith(
+    fetch(request)
+      .then((res) => {
+        if (res.ok && url.origin === location.origin) {
+          const copy = res.clone();
+          caches.open(CACHE).then((c) => c.put(request, copy));
+        }
+        return res;
+      })
+      .catch(() => caches.match(request).then((r) => r || caches.match("/")))
+  );
+});