Update TanStack Start skills for 1.0

[SarahSoutoul]

Linear ticket

What does this solve? What changed?

TanStack Start 1.0 removed the Vinxi integration and legacy server route APIs. The published skills still instructed agents to use those APIs, and their custom src/start.ts examples omitted TanStack's default CSRF protection for server functions.

• Replaces the Vinxi reference with a Vite and server setup guide, including tanstackStart(), createFileRoute('/path')({ server: { handlers } }), and the current src/routes/api/ layout.
• Registers createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === 'serverFn' }) before clerkMiddleware() in both the skill and template.
• Updates the webhook example to createFileRoute, Route, and vite.config.ts, and fixes the Vite publishable-key variable name.
• Revises the API-route evaluation and adds one for the CSRF setup.

Deadline

Aim to land before the TanStack Start 1.0 release on October 13.

After merge

• Confirm the clerk.com skills-registry refresh opens a PR pinned to the new clerk/skills revision; merge that PR and verify the public .well-known skill files.
• Advance clerk/cursor-plugin's submodules/skills pin and merge that update while the Cursor marketplace still points to that repository -> Update Clerk skills submodule after TanStack fixes cursor-plugin#3.
• Refresh the hand-maintained TanStack skill in clerk/examples .agents/skills/, confirm its .claude/skills/ symlink still points to it, and merge that update. -> https://github.com/clerk/examples/pull/95
• Update clerk/codex-plugin's sync script for the flat clerk/skills layout, run it, and merge the generated-copy update. This remains necessary until the OpenAI plugin submission switches to clerk/skills -> https://github.com/clerk/codex-plugin/pull/5

Recommended order

1. SDK — clerk/javascript#10102. Merge its follow-up Version Packages PR and verify the new @clerk/tanstack-react-start release before merging the Docs PR. Dashboard, Skills, and Quickstart can merge in any order.
2. CLI — clerk/cli#523. Merge its follow-up Version Packages PR and verify a stable clerk@latest release before the docs PR.
3. Dashboard — clerk/dashboard#10372.
4. Skills — clerk/skills#95.
5. Quickstart — clerk/clerk-tanstack-react-start-quickstart#16. Its existing Clerk SDK 1.6.4 lockfile entry already works with the PR's pinned Start and Router versions.
6. Docs — clerk/clerk#3539. Merge last, after the SDK and CLI stable releases and the other source PRs. Remove its do not merge label only when those gates are met.

[manovotny]

Pushed some changes directly in d19ad46.

• Added viteReact() after tanstackStart() in the server-setup Vite example
• Explained that a custom src/start.ts drops Start's default CSRF middleware, and that auth() throws without clerkMiddleware()
• Updated the pitfalls row to the error auth() actually throws
• Loosened eval 7 so a (context) => filter still passes
• Kept the TanStack and React plugins in the ngrok vite.config.ts example
• Noted that server routes can live anywhere under src/routes/