feat(slice-2): Landing + Sign-in screens, entry routing, API client (§5.1/5.2/6.5)

Two-step email + one-time-code sign-in behind both doors; pure entry-routing rule unit-
tested with Vitest (§6.8); storefront routing reaches a SLICE-2 signed-in placeholder with
sign-out (PUC-9). check.sh now runs the frontend unit tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/routing.ts

@@ -0,0 +1,16 @@
+// The single client-side entry-routing rule (SD-0001 §6.5). Exhaustive: every state lands
+// somewhere (BUC-4 — never stranded). Fed by one server answer (GET /api/auth/me, or the
+// verify response, which share this shape). storefront is always null in SLICE-2; SLICE-3
+// makes "admin" reachable.
+export interface SessionState {
+  account: { email: string } | null;
+  storefront: { id: number; name: string } | null;
+}
+
+export type Screen = "landing" | "create-storefront" | "admin";
+
+export function routeFor(s: SessionState): Screen {
+  if (!s.account) return "landing";
+  if (!s.storefront) return "create-storefront";
+  return "admin";
+}