fix: route browser→API calls through BFF to avoid CORS

- Create /api/onboard/request-otp and /api/auth/member/login BFF routes
- Update OnboardingForm and member-login page to call BFF instead of API directly
- Add vercel.json with monorepo build config and rootDirectory hint
- Add .vercelignore to exclude .turbo, node_modules, .next (was uploading 2.3GB)
- Add apps/web/.gitignore and update root .gitignore for tsbuildinfo files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.vercelignore

@@ -0,0 +1,14 @@
+node_modules
+.turbo
+.next
+dist
+build
+coverage
+*.tsbuildinfo
+.git
+apps/worker/sessions
+apps/api/sessions
+sessions
+.env
+.env.*
+!.env.example