Add stage 2: Vue/TypeScript PWA shell with auth-gated routing

Backend: new migration adds users.email_verified_at (null = unverified);
registration leaves it null, and the register/login/me payloads now expose
email_verified and email_verified_at.

Frontend (web/): Vite + Vue 3 + TypeScript PWA (vite-plugin-pwa). Pinia auth
store keeps the token in localStorage and validates it via GET /api/me on
load. vue-router guards redirect unauthenticated visitors to /login,
preserving the intended path; /register creates an account and signs in
immediately (with the email unverified). Placeholder home page, minimal
styling, generated icons. Dev server proxies /api to the API.

docker-compose.yml gains an optional "web" service (profile: frontend) so
`docker compose --profile frontend up -d` runs the dev server alongside the
API; `docker compose up -d` still starts the API alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/types.ts

@@ -0,0 +1,21 @@
+export interface User {
+  id: number
+  email: string
+  email_verified: boolean
+  email_verified_at: string | null
+  created_at: string | null
+}
+
+export interface AuthResponse {
+  user: User
+  token: string
+  expires_at: string
+}
+
+/** Shape of every error body returned by the API. */
+export interface ApiErrorBody {
+  error: {
+    message: string
+    details?: Record<string, string[]>
+  }
+}