M2-T06: scaffold React SPA frontend with typed OpenAPI client

- Vite + React 18 + TypeScript + Mantine + TanStack Query + react-router-dom
- typed client: openapi-typescript -> src/api/schema.d.ts (committed), openapi-fetch
- fetch wrapper middleware: cookies, X-CSRF-Token on writes, 401 -> /login,
  non-401 errors carry parsed JSON body
- SessionProvider/useSession (GET /api/session), ProtectedRoute skeleton
- app shell (Mantine + router) with placeholder login/home/config pages + gear nav
- dev proxy to FastAPI; vitest smoke test; frontend README
- npm scripts: dev/build/preview/lint/typecheck/test/codegen

frontend/src/pages/ConfigPage.tsx

@@ -0,0 +1,19 @@
+/**
+ * ConfigPage — placeholder for M2-T08.
+ *
+ * T08 replaces this with the real config UI: all config sections rendered as editable
+ * fields, secret masking, save button (PUT /api/config), and SMTP test action.
+ */
+
+import { Container, Title, Text } from '@mantine/core'
+
+export function ConfigPage() {
+  return (
+    <Container pt="xl">
+      <Title order={2}>Configuration</Title>
+      <Text c="dimmed" mt="sm">
+        Config editor — implemented in M2-T08.
+      </Text>
+    </Container>
+  )
+}