feat(appshell): integrate @abe-kap/appshell-sdk (strangler, mock fallback)

Wire the AppShell SDK for auth/identity across the CRM, gated behind
isShellConfigured() so the existing mock portal + static demo user stay
the fallback until the Shell BFF is configured.

- providers.tsx: app-wide <AppShellProvider> (auth passed only when Supabase env set)
- next.config.ts: transpilePackages + /shell -> BFF rewrite (keeps /api/geo intact)
- login: password -> login(), social -> loginWithOAuth(), OAuth return -> completeOAuthLogin()
- register: email/password sign-ups call register() on finish
- dashboard: AuthGate bounces unauthenticated visitors; topbar shows ACE identity
- docs/APPSHELL_INTEGRATION.md, .env.local.example, .npmrc for GitHub Packages

next.config.ts

@@ -1,7 +1,15 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  /* config options here */
+  // The SDK ships ESM/TS; let Next transpile it.
+  transpilePackages: ["@abe-kap/appshell-sdk"],
+  // The browser calls the Shell BFF same-origin under /shell (so the HttpOnly
+  // session cookie flows). We deliberately use /shell (NOT /api) to avoid
+  // clobbering the existing /api/geo route. Point BFF_ORIGIN at the deployed BFF.
+  async rewrites() {
+    const bff = process.env.BFF_ORIGIN ?? "http://localhost:4000";
+    return [{ source: "/shell/:path*", destination: `${bff}/api/:path*` }];
+  },
 };
 
 export default nextConfig;