feat(web): frontend foundation — Tailwind terminal theme, Query, Router, Zustand + live booth screen

Add tailwindcss (Bloomberg-terminal theme in index.css), @tanstack/react-query +
react-router, zustand, and Radix primitives. Router with role-guarded routes;
QueryClient wrapping the existing apiFetch; a small Zustand live store fed by a
/api/ws client that invalidates Query caches. Booth screen: live occupancy gauge
+ streaming entry/exit/payment feed. Vite proxies the WS upgrade.

Note: BoothScreen references the pay/exit modal + active-sessions panel added in
following commits; final HEAD builds.

apps/web/vite.config.ts

@@ -1,18 +1,25 @@
 import react from "@vitejs/plugin-react";
+import tailwindcss from "@tailwindcss/vite";
 import { defineConfig } from "vite";
 
 // Operator SPA. Built by Vite and served by Fastify in production
 // (see wiki/entities/react-vite-spa.md). The dev proxy points the API at the
 // local Fastify server.
 export default defineConfig({
-  plugins: [react()],
+  plugins: [react(), tailwindcss()],
   server: {
     port: 5173,
     proxy: {
       // Use 127.0.0.1 (not "localhost") so the proxy never tries IPv6 ::1
       // first and stall — the backend binds IPv4. Avoids slow/hung requests,
       // notably under WSL2 mirrored networking.
-      "/api": "http://127.0.0.1:3000",
+      "/api": {
+        target: "http://127.0.0.1:3000",
+        // The live booth feed (/api/ws) is a WebSocket — without `ws: true` the
+        // proxy would not forward the upgrade. The backend's Origin allowlist must
+        // include the dev origin (http://localhost:5173) via WS_ALLOWED_ORIGINS.
+        ws: true,
+      },
       "/health": "http://127.0.0.1:3000",
     },
   },