refactor(web): split into GPL standalone editor + thin reference backend

Reduce web/ to a single generic editor app plus a minimal example backend,
moving all project-specific/app code out to the closed root repo:

- apps/frontend -> standalone (@pcbjam/standalone): the GPL editor. Strips the
  project-management UI (ProjectsPage/ProjectDetailPage/UploadDropzone and the
  write half of lib/api.ts). WasmTool now takes fetchBytes + assetBaseUrl as
  injected props (decoupled from the API client) so it can be driven by either
  a backend or a local folder. New HomePage (local-folder loader + backend
  project list) and read-only ProjectView. BroadcastChannel collab unchanged.
- backend (@pcbjam/backend-example): thin Fastify+ts-rest reference impl of the
  @pcbjam/shared contract — serves a single project off the local filesystem
  (PROJECT_DIR), no DB/auth/uploads.
- packages/contract -> web/pcbjam-shared (git submodule, MIT @pcbjam/shared).
- Remove apps/server, packages/storage, packages/contract, docker-compose
  (server + storage move to the closed root repo; preserved via subtree
  branches). Rewrite pnpm-workspace/turbo/.env for the frontend-only layout.
- Add tests/fixtures/demo so the editor + example backend run out of the box.

Standalone typechecks + builds; backend serves the contract end-to-end.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/standalone/vite.config.ts

@@ -0,0 +1,59 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import react from "@vitejs/plugin-react";
+import { defineConfig, type Plugin } from "vite";
+
+/**
+ * Serve /wasm/*.gz as opaque bytes WITHOUT `Content-Encoding: gzip`.
+ *
+ * Vite's static (sirv) sets `Content-Encoding: gzip` for `.gz` files. The
+ * browser then transparently decompresses the response, so the harness's
+ * `fetch('images.tar.gz')` receives the DECOMPRESSED tar — and KiCad's gunzip
+ * of it fails with "Can't read from inflate stream: incorrect header check".
+ * We must hand the browser the raw gzip bytes, so we serve them ourselves with
+ * no Content-Encoding. Runs before the public-dir middleware.
+ */
+function serveWasmGzRaw(): Plugin {
+  const publicDir = path.resolve(__dirname, "public");
+  return {
+    name: "serve-wasm-gz-raw",
+    configureServer(server) {
+      server.middlewares.use((req, res, next) => {
+        const url = req.url?.split("?")[0] ?? "";
+        if (!/^\/wasm\/.+\.gz$/.test(url)) return next();
+        const filePath = path.join(publicDir, decodeURIComponent(url));
+        fs.stat(filePath, (err, st) => {
+          if (err || !st.isFile()) return next();
+          res.setHeader("Content-Type", "application/octet-stream");
+          res.setHeader("Content-Length", st.size);
+          // Intentionally NO Content-Encoding so fetch() yields raw gzip bytes.
+          fs.createReadStream(filePath).pipe(res);
+        });
+      });
+    },
+  };
+}
+
+export default defineConfig({
+  plugins: [serveWasmGzRaw(), react()],
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./src"),
+    },
+  },
+  server: {
+    port: 3048,
+    // KiCad WASM is cross-origin-isolated (COOP/COEP); same-origin /wasm assets
+    // load fine. Keep these so SharedArrayBuffer/threads are available.
+    headers: {
+      "Cross-Origin-Opener-Policy": "same-origin",
+      "Cross-Origin-Embedder-Policy": "require-corp",
+    },
+  },
+  preview: {
+    headers: {
+      "Cross-Origin-Opener-Policy": "same-origin",
+      "Cross-Origin-Embedder-Policy": "require-corp",
+    },
+  },
+});