feat(web): sign-in, first-run setup, app shell and user admin (M1)

- core: AuthSession keeps the access token in memory, refreshes it
  once for all parallel requests (single-flight) and retries them;
  refresh races between tabs are retried, reuse signs out; ApiError
  carries problem+json codes and field errors
- web: TanStack Router with guards — guests go to /login, the bootstrap
  admin to /setup/admin, temporary passwords to /setup/password, admin
  pages by role
- login, setup screens, Classic shell (top bar, role-based sidebar,
  empty player), settings: name, theme, language, password, devices
- users admin: search, role filter, create with a one-time temporary
  password, reset, block, role change, delete as the policy allows;
  audit log for admins
- ru/en strings for auth, admin and error codes; language and theme
  are saved in the profile

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/pages/HomePage.tsx

@@ -0,0 +1,22 @@
+import { useTranslation } from 'react-i18next';
+
+import { useUser } from '../app/session';
+import { playIcon } from '../shared/ui/icons';
+import { Icon } from '../shared/ui/ui';
+import s from './home.module.css';
+
+/** Главная. Кнопка волны — заглушка до M4 (рекомендации). */
+export function HomePage() {
+  const { t } = useTranslation();
+  const user = useUser();
+  return (
+    <div className={s.home}>
+      <h1 className={s.greeting}>{t('home.greeting', { name: user.display_name ?? user.username })}</h1>
+      <div className={s.orb} aria-disabled="true">
+        <Icon src={playIcon} size={44} />
+        <span className={s.orbLabel}>{t('home.wave')}</span>
+      </div>
+      <p className={s.soon}>{t('home.wave_soon')}</p>
+    </div>
+  );
+}