feat(appshell): integrate @abe-kap/appshell-sdk (strangler, mock fallback)

Wire the AppShell SDK for auth/identity across the CRM, gated behind
isShellConfigured() so the existing mock portal + static demo user stay
the fallback until the Shell BFF is configured.

- providers.tsx: app-wide <AppShellProvider> (auth passed only when Supabase env set)
- next.config.ts: transpilePackages + /shell -> BFF rewrite (keeps /api/geo intact)
- login: password -> login(), social -> loginWithOAuth(), OAuth return -> completeOAuthLogin()
- register: email/password sign-ups call register() on finish
- dashboard: AuthGate bounces unauthenticated visitors; topbar shows ACE identity
- docs/APPSHELL_INTEGRATION.md, .env.local.example, .npmrc for GitHub Packages

src/components/portal/register-flow.tsx

@@ -11,13 +11,17 @@ import {
   countryCodes, relationshipOptions, addressCountries,
   TERMS, PRIVACY, passwordStrength, type AddrCountry,
 } from "./data";
+import { useAuth } from "@abe-kap/appshell-sdk/react";
+import { isShellConfigured } from "@/lib/appshell";
 
 const STEPS = ["Account", "Verify", "Address"];
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
 export function RegisterFlow() {
   const router = useRouter();
+  const { register } = useAuth();
   const [step, setStep] = useState(0);
+  const [submitErr, setSubmitErr] = useState("");
 
   // shared form state
   const [sso, setSso] = useState<{ provider: string; email: string } | null>(null);
@@ -51,15 +55,23 @@ export function RegisterFlow() {
 
   const step2Valid = emailVerified && phoneVerified;
 
-  function finish() {
+  async function finish() {
+    const finalEmail = sso?.email || email;
     const profile = {
       name: `${first} ${last}`.trim(),
       initials: `${first[0] ?? ""}${last[0] ?? ""}`.toUpperCase(),
-      email: sso?.email || email,
+      email: finalEmail,
       isAllottee: isSelf,
       allotteeNames: isSelf ? null : `${alloeFirst} ${alloeLast}`.trim(),
     };
     try { localStorage.setItem("lup_profile", JSON.stringify(profile)); } catch { /* ignore */ }
+    // With the Shell live, create the real account through appshell → BFF. SSO users
+    // already have a session from OAuth, so only email/password sign-ups register here.
+    if (isShellConfigured() && !sso) {
+      setSubmitErr("");
+      try { await register(finalEmail, pw); }
+      catch { setSubmitErr("We couldn't create that account. The email may already be registered."); return; }
+    }
     router.push("/dashboard");
   }
 
@@ -92,7 +104,10 @@ export function RegisterFlow() {
       )}
 
       {step === 2 && (
-        <StepAddress onBack={() => setStep(1)} onFinish={finish} />
+        <>
+          {submitErr && <div style={{ marginBottom: 14 }}><FlashNote tone="error">{submitErr}</FlashNote></div>}
+          <StepAddress onBack={() => setStep(1)} onFinish={finish} />
+        </>
       )}
     </div>
   );