feat(plugin-a11y): align with plugin convention and add tsnapi snapshots

[antfubot]

What

The a11y inspector was the one first-party plugin not covered by the shared
tsnapi API-snapshot guard: it shipped as a private @devframes/a11y app with
no library exports, so describePackagesApiSnapshots skipped it. This brings
it fully in line with the other plugins (plugin-inspect, plugin-terminals,
plugin-git, plugin-code-server) so its public surface is snapshotted too.

Changes

• Rename + publish as a library. @devframes/a11y → @devframes/plugin-a11y,
  un-privated, with a multi-entry exports map (., /node, /cli, /vite,
  /client) built by a 3-config tsdown setup mirroring plugin-inspect.
• SPA relocation. The Solid panel moves src/client → src/spa (building to
  dist/spa) so /client can expose a clean, node-free browser module
  (connectA11y) at dist/client/index.mjs without colliding with the SPA assets.
• New entry points. createA11yDevframe() factory (src/index.ts),
  setupA11y() (/node), createA11yCli() (/cli), a11yVitePlugin() (/vite).
• Convention compliance. Adds the required devframe metadata fields
  (read from package.json), a typecheck script, devframe/vite peer deps,
  and sideEffects: false.
• Repo wiring. alias.ts (+ regenerated tsconfig.base.json paths),
  turbo.json task rename, and five committed tsnapi snapshots.

The runtime id, RPC namespace, BroadcastChannel, and mount path
(devframe-a11y-inspector) are intentionally unchanged, so the dev-server and
static-build behaviour — and their tests — are untouched.

Verification

pnpm lint, pnpm test (513 passed), pnpm typecheck, and pnpm build all pass.
The snapshot suite now covers all five plugins; a second run is stable with no
rewrites.

This PR was created with the help of an agent.

[antfubot]

Superseded by devframes#49 (same branch, targeting upstream).