fix: route browser→API calls through BFF to avoid CORS

- Create /api/onboard/request-otp and /api/auth/member/login BFF routes
- Update OnboardingForm and member-login page to call BFF instead of API directly
- Add vercel.json with monorepo build config and rootDirectory hint
- Add .vercelignore to exclude .turbo, node_modules, .next (was uploading 2.3GB)
- Add apps/web/.gitignore and update root .gitignore for tsbuildinfo files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/member-login/page.tsx

@@ -11,8 +11,6 @@ import { Input } from '../_components/ui/input';
 import { Button } from '../_components/ui/button';
 import Link from 'next/link';
 
-const API_BASE = process.env['NEXT_PUBLIC_API_URL'] ?? 'http://localhost:3001';
-
 const phoneSchema = z.object({ phone: z.string().min(8, 'Enter your WhatsApp number') });
 const otpSchema = z.object({ code: z.string().length(6, 'Enter the 6-digit code') });
 type PhoneValues = z.infer<typeof phoneSchema>;
@@ -28,7 +26,7 @@ export default function MemberLoginPage() {
   const otpForm = useForm<OtpValues>({ resolver: zodResolver(otpSchema), defaultValues: { code: '' } });
 
   async function onPhone(values: PhoneValues) {
-    const res = await fetch(`${API_BASE}/public/auth/member-login`, {
+    const res = await fetch('/api/auth/member/login', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ phone: values.phone }),