M2-T13: docs wrap-up + retire frontend constraints + dependency cleanup

- README: add 前端 v2 (React SPA) section (dev/build/codegen/hosting/gates),
  update directory listing, drop stale Jinja descriptions
- architecture-overview: retire '不引入前后端分离' constraint; reflect SPA + JSON API
- roadmap: mark M2 done
- remove orphaned jinja2 dependency (recompile requirements*.txt; no other churn)
- delete empty tests/test_auth.py stub; drop dead _extract_csrf_token in test_api_data
- verified image still builds and app imports with the slimmer deps

tests/test_api_data.py

@@ -1,7 +1,6 @@
 """Tests for M2-T03: GET /api/locations, GET /api/poo, GET /api/public-ip."""
 from __future__ import annotations
 
-import re
 from datetime import UTC, datetime
 
 from fastapi.testclient import TestClient
@@ -18,12 +17,6 @@ from app.models.public_ip import PublicIPHistory, PublicIPState
 # ---------------------------------------------------------------------------
 
 
-def _extract_csrf_token(html: str) -> str:
-    match = re.search(r'name="csrf_token" value="([^"]+)"', html)
-    assert match is not None, "csrf_token not found in HTML"
-    return match.group(1)
-
-
 def _api_login(client: TestClient) -> None:
     """Log in via POST /api/auth/login so the TestClient has a session cookie."""
     resp = client.post(