feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare

Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team
credential sharing, with the moshcode-style auth stack ported and reskinned to
match logicsrc.com (light theme, Inter, green accent).

apps/pwa
- auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie
  sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow
  (/cli/authorize + /cli/token). Ported from the moshcode PWA.
- credshare API (/api/credshare/*): teams, members, invites, vaults, sealed
  grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key.
  Zero-knowledge: only ciphertext + sealed vault keys + public keys stored.
- teams dashboard, accept-invite, and settings (API keys) pages, server-rendered
  in the LogicSRC brand (lib/html.mjs).
- migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via
  TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev.
- trimmed moshcode-specific approvals/credits/push/deliver.

CLI
- `logicsrc login` now does browser loopback OAuth-PKCE against the app and
  stores an lsk_ token (email-OTP removed); --token for CI. Client repointed.

Distribution
- install.sh (served at logicsrc.com/install.sh) installs the CLI from the
  GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper.
- root build:cli builds only the CLI's workspace chain (skips web/api/next).

Cleanup
- removed the commandboard-api credshare backend (superseded by the PWA) and its
  Supabase/Turso stores + libsql dep; commandboard-api tests green (40).
- removed the Next.js /teams page (the PWA is the web UI now).

Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login
uploads identity keys, owner pushes an encrypted .env, teammate invited ->
accepted -> granted -> pulls the exact file. Server stores ciphertext only.
Full workspace build + tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/pwa/src/migrations/001_auth.sql

@@ -0,0 +1,55 @@
+-- LogicSRC credentials app — auth schema (libSQL / SQLite).
+-- Ported from the moshcode PWA auth stack: email/password, passkeys, CoinPay
+-- OAuth, server sessions, and CLI API keys.
+
+CREATE TABLE IF NOT EXISTS users (
+  id            TEXT PRIMARY KEY,
+  email         TEXT UNIQUE,
+  password_hash TEXT,                 -- null when the user only uses passkey / coinpay
+  coinpay_sub   TEXT UNIQUE,          -- subject from "sign in with CoinPay"
+  display_name  TEXT,
+  created_at    INTEGER NOT NULL
+);
+
+-- WebAuthn / passkey credentials
+CREATE TABLE IF NOT EXISTS webauthn_credentials (
+  id            TEXT PRIMARY KEY,     -- credential id (base64url)
+  user_id       TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  public_key    TEXT NOT NULL,        -- base64url COSE public key
+  counter       INTEGER NOT NULL DEFAULT 0,
+  transports    TEXT,                 -- json array
+  created_at    INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_webauthn_user ON webauthn_credentials(user_id);
+
+-- server-side sessions (revocable cookie tokens)
+CREATE TABLE IF NOT EXISTS sessions (
+  token       TEXT PRIMARY KEY,
+  user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  created_at  INTEGER NOT NULL,
+  expires_at  INTEGER NOT NULL
+);
+
+-- API keys (lsk_…) for the logicsrc CLI to authenticate
+CREATE TABLE IF NOT EXISTS api_keys (
+  id           TEXT PRIMARY KEY,
+  user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name         TEXT,
+  token_hash   TEXT NOT NULL,         -- sha256 of the key; prefix stored for display
+  prefix       TEXT NOT NULL,
+  created_at   INTEGER NOT NULL,
+  last_used_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_apikeys_user ON api_keys(user_id);
+
+-- Short-lived authorization codes for `logicsrc login` (loopback PKCE flow).
+CREATE TABLE IF NOT EXISTS cli_auth_codes (
+  code           TEXT PRIMARY KEY,
+  user_id        TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  code_challenge TEXT NOT NULL,
+  redirect_uri   TEXT NOT NULL,
+  name           TEXT,
+  used           INTEGER NOT NULL DEFAULT 0,
+  created_at     INTEGER NOT NULL,
+  expires_at     INTEGER NOT NULL
+);

apps/pwa/src/migrations/002_credshare.sql

@@ -0,0 +1,91 @@
+-- LogicSRC credential sharing — teams, vaults, and end-to-end-encrypted secrets.
+-- Zero-knowledge: only ciphertext, per-member sealed vault keys, and member
+-- identity public keys are stored. Members are the app's `users`.
+
+-- A member's X25519 identity public key (one per user; the secret key stays on
+-- their device in ~/.logicsrc/identity.json and is never uploaded).
+CREATE TABLE IF NOT EXISTS credshare_keys (
+  user_id     TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+  public_key  TEXT NOT NULL,
+  updated_at  INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS credshare_teams (
+  id          TEXT PRIMARY KEY,
+  slug        TEXT NOT NULL UNIQUE,
+  name        TEXT NOT NULL,
+  created_by  TEXT NOT NULL REFERENCES users(id),
+  created_at  INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS credshare_members (
+  id          TEXT PRIMARY KEY,
+  team_id     TEXT NOT NULL REFERENCES credshare_teams(id) ON DELETE CASCADE,
+  user_id     TEXT REFERENCES users(id) ON DELETE SET NULL,
+  email       TEXT NOT NULL,
+  role        TEXT NOT NULL DEFAULT 'member',   -- owner | admin | member
+  status      TEXT NOT NULL DEFAULT 'invited',  -- active | invited
+  invited_by  TEXT REFERENCES users(id),
+  joined_at   INTEGER,
+  created_at  INTEGER NOT NULL,
+  UNIQUE(team_id, email)
+);
+CREATE INDEX IF NOT EXISTS idx_credshare_members_team ON credshare_members(team_id);
+CREATE INDEX IF NOT EXISTS idx_credshare_members_user ON credshare_members(user_id);
+
+CREATE TABLE IF NOT EXISTS credshare_invites (
+  id          TEXT PRIMARY KEY,
+  team_id     TEXT NOT NULL REFERENCES credshare_teams(id) ON DELETE CASCADE,
+  email       TEXT NOT NULL,
+  role        TEXT NOT NULL DEFAULT 'member',
+  token_hash  TEXT NOT NULL UNIQUE,
+  created_by  TEXT NOT NULL REFERENCES users(id),
+  expires_at  INTEGER NOT NULL,
+  accepted_at INTEGER,
+  created_at  INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS credshare_vaults (
+  id          TEXT PRIMARY KEY,
+  team_id     TEXT NOT NULL REFERENCES credshare_teams(id) ON DELETE CASCADE,
+  name        TEXT NOT NULL,
+  created_by  TEXT NOT NULL REFERENCES users(id),
+  created_at  INTEGER NOT NULL,
+  UNIQUE(team_id, name)
+);
+
+-- Vault data-encryption key sealed to a member's public key (one row per member).
+CREATE TABLE IF NOT EXISTS credshare_vault_grants (
+  vault_id    TEXT NOT NULL REFERENCES credshare_vaults(id) ON DELETE CASCADE,
+  user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  wrapped_dek TEXT NOT NULL,
+  granted_by  TEXT NOT NULL REFERENCES users(id),
+  created_at  INTEGER NOT NULL,
+  PRIMARY KEY (vault_id, user_id)
+);
+
+-- Encrypted secrets (ciphertext + nonce decrypt only with the vault DEK, which
+-- the server never sees). fingerprint is a salted hash for redacted diffs.
+CREATE TABLE IF NOT EXISTS credshare_secrets (
+  vault_id    TEXT NOT NULL REFERENCES credshare_vaults(id) ON DELETE CASCADE,
+  name        TEXT NOT NULL,
+  nonce       TEXT NOT NULL,
+  ciphertext  TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  version     INTEGER NOT NULL,
+  updated_by  TEXT NOT NULL REFERENCES users(id),
+  updated_at  INTEGER NOT NULL,
+  PRIMARY KEY (vault_id, name)
+);
+
+CREATE TABLE IF NOT EXISTS credshare_audit (
+  id            TEXT PRIMARY KEY,
+  team_id       TEXT,
+  vault_id      TEXT,
+  actor_user_id TEXT NOT NULL REFERENCES users(id),
+  action        TEXT NOT NULL,
+  key_name      TEXT,
+  fingerprint   TEXT,
+  created_at    INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_credshare_audit_vault ON credshare_audit(vault_id, created_at DESC);