Update TanStack Start quickstart for CSRF protection

[SarahSoutoul]

Linear ticket

Summary

• Upgrade Clerk and TanStack Start together: @clerk/tanstack-react-start to 1.6.4, @tanstack/react-start to 1.168.60, Router to 1.170.41, and Router Devtools to 1.167.2.
• Register TanStack's CSRF middleware for server functions before clerkMiddleware() in src/start.ts.
• Handle Router's unknown error type and include the regenerated route tree.

Open PR audit

• SDK PR #10102 raises Clerk's peer minimums to Start ^1.168.10 and Router ^1.170.7. This quickstart's Start 1.168.60 and Router 1.170.41 satisfy those ranges.
• Dependabot PR #10 is a lockfile-only update to @tanstack/start-server-core 1.168.4 and h3. This PR resolves @tanstack/start-server-core 1.169.39 and the h3 update, so chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #10 is superseded once this PR merges.
• PR #6 is an intentional TanStack bug reproduction marked "Do not merge"; it is now closed.
• PR #7 proposes a protected-routes example, and PR #9 adds a security policy. Both are independent of this upgrade.

After merge

Current dependency state: package.json declares @clerk/tanstack-react-start ^1.6.4, and pnpm-lock.yaml resolves 1.6.4. This SDK works with the PR's Start 1.168.60 and Router 1.170.41 pins. No SDK dependency change is needed for this PR.

• Verify the main branch installs from its committed lockfile and builds with SDK 1.6.4 and the pinned TanStack packages.
• Smoke-test the example's sign-in flow and a protected server function in the deployed example, if one is available.
• Confirm Dependabot PR #10 is fully superseded by the merged lockfile, then close it. Review community PR #7 and PR #9 separately.

Recommended order

1. SDK — clerk/javascript#10102. Merge its follow-up Version Packages PR and verify the new @clerk/tanstack-react-start release before merging the Docs PR. Dashboard, Skills, and Quickstart can merge in any order.
2. CLI — clerk/cli#523. Merge its follow-up Version Packages PR and verify a stable clerk@latest release before the docs PR.
3. Dashboard — clerk/dashboard#10372.
4. Skills — clerk/skills#95.
5. Quickstart — clerk/clerk-tanstack-react-start-quickstart#16. Its existing Clerk SDK 1.6.4 lockfile entry already works with the PR's pinned Start and Router versions.
6. Docs — clerk/clerk#3539. Merge last, after the SDK and CLI stable releases and the other source PRs. Remove its do not merge label only when those gates are met.