M2-T06: scaffold React SPA frontend with typed OpenAPI client

- Vite + React 18 + TypeScript + Mantine + TanStack Query + react-router-dom
- typed client: openapi-typescript -> src/api/schema.d.ts (committed), openapi-fetch
- fetch wrapper middleware: cookies, X-CSRF-Token on writes, 401 -> /login,
  non-401 errors carry parsed JSON body
- SessionProvider/useSession (GET /api/session), ProtectedRoute skeleton
- app shell (Mantine + router) with placeholder login/home/config pages + gear nav
- dev proxy to FastAPI; vitest smoke test; frontend README
- npm scripts: dev/build/preview/lint/typecheck/test/codegen

frontend/src/pages/LoginPage.tsx

@@ -0,0 +1,19 @@
+/**
+ * LoginPage — placeholder for M2-T07.
+ *
+ * T07 replaces this with the real login form (username/password → POST /api/auth/login,
+ * force-password-change flow, redirect to home on success).
+ */
+
+import { Container, Title, Text } from '@mantine/core'
+
+export function LoginPage() {
+  return (
+    <Container size="xs" pt="xl">
+      <Title order={2}>Login</Title>
+      <Text c="dimmed" mt="sm">
+        Login form — implemented in M2-T07.
+      </Text>
+    </Container>
+  )
+}