feat(appshell): integrate @abe-kap/appshell-sdk (strangler, mock fallback)

Wire the AppShell SDK for auth/identity across the CRM, gated behind
isShellConfigured() so the existing mock portal + static demo user stay
the fallback until the Shell BFF is configured.

- providers.tsx: app-wide <AppShellProvider> (auth passed only when Supabase env set)
- next.config.ts: transpilePackages + /shell -> BFF rewrite (keeps /api/geo intact)
- login: password -> login(), social -> loginWithOAuth(), OAuth return -> completeOAuthLogin()
- register: email/password sign-ups call register() on finish
- dashboard: AuthGate bounces unauthenticated visitors; topbar shows ACE identity
- docs/APPSHELL_INTEGRATION.md, .env.local.example, .npmrc for GitHub Packages

.env.local.example

@@ -0,0 +1,16 @@
+# appshell-sdk / Shell BFF config. Leave unset to keep the existing mock portal
+# (the app still runs). Set these once the Shell BFF is deployed for real auth.
+
+# Browser-safe Supabase config (the anon key is PUBLISHABLE — never service_role):
+NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=<publishable-anon-key>
+
+# Where the browser reaches the Shell BFF (same-origin path; rewritten to BFF_ORIGIN).
+NEXT_PUBLIC_BFF_BASE_URL=/shell
+
+# The deployed Shell BFF origin — the /shell/* rewrite proxies here (see next.config.ts).
+BFF_ORIGIN=http://localhost:4000
+
+# Installing @abe-kap/appshell-sdk (GitHub Packages) needs a read:packages token:
+#   locally:  export NODE_AUTH_TOKEN=<token>   before npm install
+#   Vercel:   set NODE_AUTH_TOKEN as a project env var