feat: add SPA, serve at /app/, update Dockerfile and README

- React + TanStack Router + shadcn/ui SPA under spa/
- serve spa/dist at /app/ with index.html fallback for client routing
- Dockerfile: node build stage for SPA, copy dist into runtime image
- README: document SPA, CORS_ORIGINS env var, architecture entry
- vite base set to /app/, manifest.json paths fixed

spa/src/main.tsx

@@ -0,0 +1,27 @@
+import { StrictMode } from "react"
+import { createRoot } from "react-dom/client"
+import { QueryClientProvider } from "@tanstack/react-query"
+import { createRouter, RouterProvider } from "@tanstack/react-router"
+import { AuthProvider } from "@/components/auth-provider"
+import { queryClient } from "@/lib/query-client"
+import { routeTree } from "./routeTree.gen"
+import "@/i18n"
+import "./index.css"
+
+const router = createRouter({ routeTree, basepath: "/app" })
+
+declare module "@tanstack/react-router" {
+  interface Register {
+    router: typeof router
+  }
+}
+
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <AuthProvider>
+      <QueryClientProvider client={queryClient}>
+        <RouterProvider router={router} />
+      </QueryClientProvider>
+    </AuthProvider>
+  </StrictMode>,
+)