refactor(web): switch to Bun + Nitro v2 (bun preset) — proper TanStack Start deploy

The earlier "render the shell with a custom script" was a hack. The real issues were a
version matrix and a missing server target:

- TanStack Start's start-plugin-core peer-requires Vite >= 7; on Vite 6 the build's
  prerender/post-build buildApp plugin hook silently doesn't run (Vite 6 lets a
  config-level builder.buildApp suppress plugin buildApp hooks; Vite 7 runs both). Pinned
  Vite ^7 + @vitejs/plugin-react ^5 (v5 ↔ Vite 7; v6 needs Vite 8 / vite/internal).
- Added @tanstack/nitro-v2-vite-plugin with the `bun` preset — the server/deploy target.
  `bun run build` → .output/ (bun-runnable server + .output/public). `bun run start` =
  `bun run .output/server/index.mjs`.
- Full SSR instead of SPA mode: SPA-shell prerender points its preview server at the old
  dist/server/server.js path that Nitro relocates, breaking the build. The Nitro server
  renders the shell per request; React Query fetches client-side after hydration.
- Nitro routeRules proxy /api/** → PUNKTFUNK_MGMT_URL (default 127.0.0.1:47990), so the
  browser stays same-origin (bearer token rides along, no CORS).

Toolchain is now Bun (package manager + runtime): bun.lock replaces pnpm-lock.yaml;
scripts/prepare/start use bun. Validated live: bun build → .output, bun server SSR-renders
the console on :3000 and proxies the API (health/host return through it). tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/vite.config.ts

@@ -1,13 +1,14 @@
 import { defineConfig } from 'vite'
 import { tanstackStart } from '@tanstack/react-start/plugin/vite'
+import { nitroV2Plugin } from '@tanstack/nitro-v2-vite-plugin'
 import viteReact from '@vitejs/plugin-react'
 import viteTsConfigPaths from 'vite-tsconfig-paths'
 import tailwindcss from '@tailwindcss/vite'
 import { paraglideVitePlugin } from '@inlang/paraglide-js'
 
-// The management API the console drives. In dev we proxy same-origin so the browser
-// never needs CORS and the bearer token (when set) rides along untouched. Override the
-// target with PUNKTFUNK_MGMT_URL when the host isn't on the default loopback port.
+// The management API the console drives. The browser always talks same-origin (/api/...):
+// in `vite dev` the dev server proxies it (below); in the built Bun/Nitro server a Nitro
+// route-rule proxies it (below). Override the upstream with PUNKTFUNK_MGMT_URL.
 const MGMT_URL = process.env.PUNKTFUNK_MGMT_URL ?? 'http://127.0.0.1:47990'
 
 export default defineConfig({
@@ -24,10 +25,20 @@ export default defineConfig({
       outdir: './src/paraglide',
       strategy: ['localStorage', 'preferredLanguage', 'baseLocale'],
     }),
-    tanstackStart({
-      // A management console for a loopback host — render it as a client SPA (no SSR data
-      // fetching against a token-gated local API), still on the TanStack Start runtime.
-      spa: { enabled: true },
+    // Full SSR on the TanStack Start runtime (the management console's data queries run
+    // client-side after hydration — React Query doesn't fetch during SSR — so the server
+    // renders a data-free shell that hydrates in the browser).
+    tanstackStart(),
+    // Nitro v2 is the deployment target: the `bun` preset bundles a Bun-runnable server to
+    // .output/ (`bun run .output/server/index.mjs`). The route-rule keeps the browser
+    // same-origin by proxying /api/** to the management host, so the bearer token and
+    // cookies ride along with no CORS.
+    nitroV2Plugin({
+      preset: 'bun',
+      compatibilityDate: '2026-06-10',
+      routeRules: {
+        '/api/**': { proxy: `${MGMT_URL}/api/**` },
+      },
     }),
     // Must come AFTER tanstackStart — provides the React JSX transform + Refresh runtime
     // that Start's dev mode requires (omitting it leaves the client JS unable to load).