fix: route browser→API calls through BFF to avoid CORS

- Create /api/onboard/request-otp and /api/auth/member/login BFF routes
- Update OnboardingForm and member-login page to call BFF instead of API directly
- Add vercel.json with monorepo build config and rootDirectory hint
- Add .vercelignore to exclude .turbo, node_modules, .next (was uploading 2.3GB)
- Add apps/web/.gitignore and update root .gitignore for tsbuildinfo files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/onboard/OnboardingForm.tsx

@@ -43,8 +43,6 @@ const SCOPE_META: ScopeMeta[] = [
   },
 ];
 
-const API_BASE = process.env['NEXT_PUBLIC_API_URL'] ?? 'http://localhost:3001';
-
 export function OnboardingForm({ token, groupName, tenantName, defaultScopes, defaultRetentionDays }: Props) {
   const [step, setStep] = useState<Step>('welcome');
   const [phone, setPhone] = useState('');
@@ -62,7 +60,7 @@ export function OnboardingForm({ token, groupName, tenantName, defaultScopes, de
     setError(null);
     setBusy(true);
     try {
-      const res = await fetch(`${API_BASE}/public/auth/request-otp`, {
+      const res = await fetch('/api/onboard/request-otp', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
         body: JSON.stringify({ onboardingToken: token, phone }),