feat(site): WP-19 catalog site — read-only product page over the indexer API

[jefflau]

What

Adds apps/site (@enspack/site): a static Vite + React catalog site that renders the indexer JSON API (MVP.md §4.3) so a visitor can see what an enspack name is, what it points at, and that it verifies — without installing the CLI. This is MVP criterion 7 / WP-19 (already added to MVP.md on master in 36c1a90). Decision record and build spec live in the Project store (docs/catalog-site-decision.md, docs/catalog-site-spec.md). SPEC.md and schema/* untouched.

Pages:

• / — hero with copyable enspack get …, live stats, how-it-works (Name → Manifest → Bytes → Verify), searchable model list with publisher filter and cursor pagination. Hero and stats stay on the unfiltered catalog.
• /name/:name — the selling page: trust chain (ENS name → contenthash CID → manifest → infohash/magnet/webseeds → per-file SHA-256), sortable files table with full hashes + copy (stacks under 720px), versions, and a "Get it" panel with the enspack.lock entry per SPEC §9 (collapsed by default).
• /publisher/:label — HF proof + registrar attestation (GET /v1/publishers/:label) as key/value with explorer links; explicit "no attestation" state for mirrors.enspack.eth / self-owned names.
• /violations — SPEC §6.2 audit surface with an informative empty state.
• /get-started — quickstart, publish flow, registrar CTA.

Data layer: HttpIndexClient / FixtureIndexClient; config from VITE_INDEX_URL, VITE_REGISTRAR_URL, VITE_CHAIN, VITE_DATA_SOURCE=http|demo. No wallet, no writes, no RPC URL or keys in the bundle; @enspack/core is type-only.

Indexer: hono/cors on GET /v1/* so the browser can call index.enspack.dev from enspack.dev.

Verification

• Root pnpm check green across all 12 workspace projects; CI green on 4e95f9c.
• Site: 31 vitest tests against recorded fixtures (no network) covering every page, empty/error states, the data clients, sorting, the collapsed lock entry, document titles and the clipboard fallback.
• Indexer: CORS header test.
• Visual QA pass (desktop 1280 + mobile 360/420) and a responsive polish round; demo video recorded in VITE_DATA_SOURCE=demo mode.

enspack_catalog_site_demo_home_model_trust_chain_publisher_violations.mp4

Not in this PR

• Cloudflare Pages project and enspack.dev DNS (manual; see apps/site/README.md).
• Live run against the Sepolia indexer — pending the indexer deployment from WP-21 infra. Acceptance item "home page lists the bootstrapped mirrors" is verified only against fixtures for now.

_{To show artifacts inline, enable in settings.}