feat(embed): add the browser client (client + kit)

[mattj-monad]

Layer 2 of the Monad Embed SDK staged rollout (PRO-401). Stacked on #12 (PRO-400) — review/merge that first; this PR targets feature/pro-400.

What this adds

The two remaining @monad-inc/embed entrypoints (connect is already on main):

• src/client — the 9-route browser client (createEmbedClient) host front-ends call: catalog, connectors, session, and pipeline build/status/state/remove.
• src/kit — the backend-only Monad client (session, catalog, pipeline, teams) hosts/routers use server-side.

Plus the ./client and ./kit subpath exports and the tsup/tsconfig build wiring.

Shared eslint config finalized here

This is the first layer with lintable SDK source, so I brought the shared eslint.config.js to its final form in one place: ignore **/.venv/** (Python harness assets), grant node globals to .mjs/.cjs scripts, and allow _-prefixed unused args. Downstream router/conformance layers won't need to touch it.

Verification (local)

• tsc --noEmit clean; vitest 19/19 green (client 12, kit 7)
• lint: 0 errors (3 intentional no-explicit-any warnings — Monad API responses are deliberately untyped JSON)
• prettier --check clean; tsup build succeeds for connect/client/kit

Stack

400 (contract) → 401 (client) → 402 (TS router + conformance) → 403 (Go) → 404 (Python) → 405 (docs/CI).

🤖 Generated with Claude Code

https://claude.ai/code/session_011ASKA2VrufrNLGGrcFjY7n

[mattj-monad]

Force-pushed a review fix. The browser client's success path now surfaces a non-JSON 2xx — e.g. an expired-host-session HTML login page served with status 200 — as a branded EmbedRequestError('invalid_response') instead of a raw SyntaxError the caller isn't told to expect. 19 unit tests green.

[andrewc-monad]

Code looks good. There's 1 or 2 things I'd suggest to change but they'd be more over-reaching and might affect other PRs above this one in the stack, so they can be pushed to later.