feat(web): migrate to Next.js App Router and add design tokens (ADR 0018)

The Sprint 1 shell moves to /app with its own root layout so its dark theme does not leak. Figma tokens ported with light and dark parity.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014SdXCbrN5PtGExkpvMaMHx

web/next.config.ts

@@ -0,0 +1,16 @@
+import type { NextConfig } from 'next';
+
+const apiOrigin = process.env.WURSOR_API_URL ?? 'http://localhost:3000';
+
+const config: NextConfig = {
+  reactStrictMode: true,
+  // Interim: the Sprint 1 shell at /app still calls the API on the same origin.
+  // Replaced by server-held sessions (ADR 0018, step C).
+  async rewrites() {
+    return ['/auth/:path*', '/chat/:path*', '/chat', '/sites/:path*', '/sites', '/health'].map(
+      (source) => ({ source, destination: `${apiOrigin}${source}` }),
+    );
+  },
+};
+
+export default config;