feat: scaffold UI web (React/Vite/Tailwind) + Login (v0.22.0)

Package web/ : React 19 + Vite 8 + Tailwind 4 + react-router 7 + PWA.
Tokens dark HUD Jarvis-red, client API, contexte auth JWT, shell + garde
de route, écran Login (mot de passe + TOTP). Chat/Review en stubs. Build
OK, 0 vuln. docs/ui-design.md.

Palier de risque : reversible (front statique, aucun accès infra direct).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/src/App.tsx

@@ -0,0 +1,42 @@
+import { BrowserRouter, Routes, Route, NavLink, Navigate } from "react-router-dom";
+import { useAuth } from "./auth";
+import { Login } from "./pages/Login";
+import { Chat } from "./pages/Chat";
+import { Review } from "./pages/Review";
+
+function Shell() {
+  const { logout } = useAuth();
+  const link = ({ isActive }: { isActive: boolean }): string =>
+    `px-3 py-2 rounded-md text-sm ${isActive ? "bg-surface-2 text-accent" : "text-muted hover:text-fg"}`;
+
+  return (
+    <div className="min-h-dvh flex flex-col">
+      <header className="flex items-center gap-2 border-b border-border bg-surface px-4 py-2">
+        <span className="font-bold tracking-wide text-accent glow mr-2">CHLOVA</span>
+        <nav className="flex gap-1">
+          <NavLink to="/chat" className={link}>Chat</NavLink>
+          <NavLink to="/review" className={link}>Review</NavLink>
+        </nav>
+        <button onClick={logout} className="ml-auto text-sm text-muted hover:text-fg cursor-pointer">
+          Déconnexion
+        </button>
+      </header>
+      <main className="flex-1 min-h-0">
+        <Routes>
+          <Route path="/chat" element={<Chat />} />
+          <Route path="/review" element={<Review />} />
+          <Route path="*" element={<Navigate to="/chat" replace />} />
+        </Routes>
+      </main>
+    </div>
+  );
+}
+
+export function App() {
+  const { token } = useAuth();
+  return (
+    <BrowserRouter>
+      {token ? <Shell /> : <Login />}
+    </BrowserRouter>
+  );
+}