chore: split the client core into @seamless-auth/client as an npm workspace

[Bccorb]

Summary

Phase 3 of #64 (workspace conversion), pulled forward because a React Native binding is next (fells-code/seamless-templates#40) and it must share the client core rather than copy it.

• The repository is now an npm workspace with two published packages:
  • packages/client → @seamless-auth/client (new, 0.1.0 on release): createSeamlessAuthClient, createAuthSession, SessionStoragePort + implementations, createFetchWithAuth, error and result types, PRF helpers, role matching, wire type aliases. Lint-enforced: no React, router, or React Native imports, and no imports from a binding package.
  • packages/react → @seamless-auth/react (patch): depends on @seamless-auth/client and re-exports the same public surface as before. No runtime behaviour change.
• Files moved with git mv, so history follows them.
• Tests run as two Jest projects from the root. The React project maps @seamless-auth/client to the client source, so a core change is exercised by the React suite without a build in between; packages/react/tsconfig.json carries the same mapping for type-checking and tsconfig.build.json drops it so emitted declarations reference the package by name.
• Root scripts keep their names (lint, test, build, typecheck, check-npm-build), so ci.yml and release.yml run unchanged; build runs client before react explicitly.
• Changesets: packages version independently (linked: []), client starts at 0.0.0 with a minor changeset so the first publish is 0.1.0.
• AGENTS.md architecture section rewritten for the workspace; new root README and packages/client/README.md.

Kept as a local copy rather than a re-export: scopedRoles.ts. @seamless-auth/types/role/matching only declares import/types export conditions, which Jest 29 under jsdom cannot resolve (no require/default), and any Jest-based consumer of the client bundle would hit the same. Worth a default condition upstream; noted, not done here.

Depends on

fells-code/seamless-cli#203: seamless verify --local packs the react checkout with npm pack at the repo root. With the workspace that produces the private root package, so the harness now packs -w @seamless-auth/client -w @seamless-auth/react when it sees workspaces. The conformance.yml check on this PR consumes that reusable workflow @main, so it will go green once #203 merges.

Test plan

• npm run lint clean
• npm test: 327 passing across both projects, coverage 90.25 / 80.03 / 90.03 / 90.29
• npm run typecheck both packages
• npm run build both packages; react bundle externals are @seamless-auth/client, libphonenumber-js, react, react-router-dom; client bundle external is @simplewebauthn/browser
• npm run check-npm-build: both tarballs carry dist, README, CHANGELOG, LICENSE
• npx changeset status: client minor, react patch