feat(web): sign-in, first-run setup, app shell and user admin (M1)

- core: AuthSession keeps the access token in memory, refreshes it
  once for all parallel requests (single-flight) and retries them;
  refresh races between tabs are retried, reuse signs out; ApiError
  carries problem+json codes and field errors
- web: TanStack Router with guards — guests go to /login, the bootstrap
  admin to /setup/admin, temporary passwords to /setup/password, admin
  pages by role
- login, setup screens, Classic shell (top bar, role-based sidebar,
  empty player), settings: name, theme, language, password, devices
- users admin: search, role filter, create with a one-time temporary
  password, reset, block, role change, delete as the policy allows;
  audit log for admins
- ru/en strings for auth, admin and error codes; language and theme
  are saved in the profile

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/i18n/locales/ru/errors.json

@@ -3,7 +3,8 @@
     "internal": "Что-то пошло не так на сервере. Попробуйте ещё раз",
     "bad_request": "Некорректный запрос",
     "not_found": "Не найдено",
-    "method_not_allowed": "Действие не поддерживается"
+    "method_not_allowed": "Действие не поддерживается",
+    "network": "Нет связи с сервером. Проверьте сеть"
   },
   "auth": {
     "invalid_credentials": "Неверный логин или пароль",