package: ship a prebuilt React portal in the npm tarball

[WalksWithASwagger]

Summary

Package the prebuilt React portal and prove the npm tarball works from a disposable installation.

Context

• Blocked by frontend: add a focused unit and component test foundation #328, ci: pin Actions and add dependency and code-security monitoring #331, and package: adopt the scoped npm identity without publishing #332.
• Roadmap phase: Phase 1 - package readiness
• Relevant files: package.json, package-lock.json, index.js, scripts/check-package-boundary.mjs, a new installed-package smoke script, .github/workflows/ci.yml, README.md, docs/FRONTEND.md, and only minimal server path handling if the smoke exposes a defect
• Current behavior: the React portal is built from checkout sources but the npm tarball does not prove a self-contained installed frontend experience.
• Desired behavior: packaging builds and includes the Nitro output while generated bundle artifacts remain ignored and uncommitted.

Implementation Notes

• Build the frontend as part of packaging and include only the required self-contained output.
• Run install smoke from a disposable tarball directory, never from repository assumptions.
• Preserve /legacy-suite and /legacy-library for this release and mark them deprecated.
• Keep generated frontend/.output ignored and absent from Git.

Acceptance Criteria

• npm pack builds and includes the required self-contained Nitro output.
• frontend/.output remains ignored and uncommitted.
• A disposable tarball-install smoke proves React routes, static assets, API proxying, dry-run generation, and clean shutdown.
• Package-boundary checking fails if required bundle entrypoints are missing or forbidden files enter the tarball.
• Legacy suite and library routes remain available and visibly deprecated.
• Full deterministic and security verification passes from the reviewed commit.

Tests/Evals

• Add an installed-package smoke that uses temporary directories and dry-run fixtures only.
• No provider, deployment, or network generation calls.

Verification

• npm run pack:check
• Run the installed-tarball smoke in a disposable directory.
• npm run verify
• npm run verify:security
• git status --short proves no build artifacts were committed.

Agent Instructions

• Use branch codex/issue-<this-issue>-package-prebuilt-portal.
• Do not start until frontend: add a focused unit and component test foundation #328, ci: pin Actions and add dependency and code-security monitoring #331, and package: adopt the scoped npm identity without publishing #332 are merged.
• Do not publish, tag, deploy, or remove legacy routes.
• Keep any server change limited to an installed-package path defect proven by the smoke.

Human Checkpoints

• Maintainer review is required before merge because this changes the public tarball contract.

Out of Scope

• npm publication or GitHub release creation.
• Legacy route deletion.
• Provider calls or generated image evaluation.
• Broad server refactoring.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.