Protect /workspace at the edge, add auth-guard regression tests, reproducible installs

[freebuff-web]

Why

The edge proxy (apps/web/src/proxy.ts) rejected unauthenticated requests for dashboard, submit, onboarding and friends, but not /workspace - the entire authenticated transaction workspace. Every /workspace page happened to carry its own guard, so nothing was exposed today, but any new workspace route added without a guard would have been served unauthenticated at the edge. The repo also had no .gitignore, so dependencies, build output and future secret files were stageable, and no committed lockfile, so installs were not reproducible.

What changed

• apps/web/src/proxy.ts - added workspace to the protectedPath prefixes so unauthenticated requests are redirected to /login before any page or server action runs.
• apps/web/tests/authGuards.test.ts (new) - three regression tests in the style of the existing suite: the proxy protects every authenticated prefix, every workspace page performs its own server-side auth check, and the mutating server actions verify the user plus organization membership.
• .gitignore (new) - ignores dependency folders, Next build output, tsbuildinfo, environment files, logs and editor/OS files.
• pnpm-lock.yaml (new, committed) - locks dependency resolution for reproducible installs.
• apps/web/tsconfig.json, apps/web/next-env.d.ts - framework-generated updates from next dev / next build.
• .claude/skills/bashar/SKILL.md - the project skill definition, included as part of committing all current changes.

Verification

• npm test -> 25/25 pass (22 pre-existing + 3 new)
• npm run typecheck (tsc --noEmit) -> clean; tsc -b --noEmit -> clean
• npm run lint -> 0 errors (3 pre-existing img warnings, unchanged)
• npm run i18n:check -> 810 keys, 0 missing / 0 untranslated
• npm run build (next build incl. prebuild i18n + eslint) -> exit 0
• Runtime against the dev preview: / -> 200, /login -> 200, unauthenticated /workspace -> redirects to /login (previously it rendered the workspace shell boundary)

Generated with Codebuff
Co-Authored-By: Codebuff noreply@codebuff.com