Enforce framework-agnostic boundary in the client layer

[Bccorb]

Summary

Make the framework-agnostic boundary in the client layer enforced by lint instead of merely conventional, so a future core extraction is a mechanical move rather than an untangling job.

Background

These modules already have zero React imports and are pure client logic:

• src/client/createSeamlessAuthClient.ts
• src/client/webauthnPrf.ts
• src/client/webauthnSupport.ts
• src/fetchWithAuth.ts
• src/scopedRoles.ts
• src/types.ts

Nothing prevents someone from importing a React hook or provider into that layer tomorrow. The moment that happens, the layer stops being extractable and the coupling is discovered late.

Proposed change

1. Add an ESLint boundary rule (eslint-plugin-import is already a dev dependency, so import/no-restricted-paths zones work) that forbids the client layer from importing:
   • react and react-dom
   • react-router-dom
   • anything under src/AuthProvider.tsx, src/hooks/**, src/views/**, src/components/**
2. Optionally consolidate the pure modules under a single directory so the restricted zone is one path rather than a file list. This is a larger diff because of import updates, so it can be a follow-up if preferred.

Acceptance

• npm run lint fails when a client-layer module imports React or a React-layer module.
• No behavior change and no public API change.

Why now

This is cheap and buys the option value of the extraction without paying for the extraction. It is a prerequisite for #64.