feat(client): 初始化前端壳与鉴权守卫（P1-5）

- 技术栈：React 18 + TypeScript + Vite + Tailwind

- API 层：ApiError + 401 自动刷新 + single-flight 重试

- 鉴权：内存 Access Token + Cookie Refresh + 启动 bootstrap

- RBAC：权限映射 + RequireAuth/RequirePermission 路由守卫

- 布局：OA 工作台壳层 + 侧边栏 + 5 个占位页面

- 样式：复用 hyb-web 视觉 token（单向同步）

- 文档：新增 client README，补充 server 联调说明

client/src/layouts/AppShellLayout.tsx

@@ -0,0 +1,23 @@
+import { Outlet } from "react-router-dom";
+import { Sidebar } from "../components/navigation/Sidebar";
+import { Topbar } from "../components/navigation/Topbar";
+
+export function AppShellLayout() {
+  return (
+    <div className="min-h-screen bg-background-light">
+      <div className="flex min-h-screen">
+        <Sidebar />
+
+        <div className="flex min-w-0 flex-1 flex-col">
+          <Topbar />
+
+          <main className="flex-1 p-4 sm:p-6">
+            <div className="layout-container max-w-none">
+              <Outlet />
+            </div>
+          </main>
+        </div>
+      </div>
+    </div>
+  );
+}

client/src/layouts/AuthLayout.tsx

@@ -0,0 +1,11 @@
+import { Outlet } from "react-router-dom";
+
+export function AuthLayout() {
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-gradient-to-br from-primary-50 via-background-light to-slate-100 p-6">
+      <div className="w-full max-w-md">
+        <Outlet />
+      </div>
+    </div>
+  );
+}