refactor(studio): split API and web workspaces

[tlgimenes]

Summary

• split the former full-stack apps/mesh workspace into the Hono backend at apps/api and the Vite/React application at apps/web
• consolidate internal contracts, SDK utilities, and async primitives into the private @decocms/shared package while keeping browser-only SDK code inside apps/web
• update development, build, deployment, CI, test, and worktree tooling for the new workspace boundaries
• standardize READMEs for all 14 direct app and package workspaces and enforce the format with check:readmes

Architectural boundaries

• apps/web does not import server implementation from apps/api
• apps/api does not import application code from apps/web
• @decocms/shared remains private, isomorphic, and free of application/runtime ownership
• web-only React hooks and transports remain local to apps/web/src/sdk

Validation

• bun run check
• bun run fmt:check
• bun run lint
• bun run knip
• bun run --cwd=apps/docs build (322 pages)
• bun run --cwd=packages/harness test (363 tests)
• workspace README validator (14 workspaces)

Full Playwright E2E was not rerun because it requires the external Postgres, NATS, and browser service stack.

---

Summary by cubic

Split the former full‑stack apps/mesh into apps/api (Hono backend/CLI) and apps/web (Vite/React), introduced a private @decocms/shared package for isomorphic contracts and utils, and overhauled CI/release/tests/docs to enforce the new boundaries. One build (bun run build:studio) now stages the web bundle into the API dist; the release publishes decocms to npm and pushes separate API and web images from the same tarball.

• Refactors

  • Moved server code to apps/api and web UI to apps/web; enforced boundaries with ban-cross-tree-imports and ban-web-server-imports.
  • Consolidated shared contracts, SDK utilities, and async primitives into packages/shared with imports via @decocms/shared/*; removed publish workflows for @decocms/mesh-sdk and @decocms/std.
  • Replaced the legacy release with “Release Studio”: build:studio produces one tarball used to publish npm (decocms from apps/api) and build/push GHCR images for API (apps/api/Dockerfile) and web (apps/web/Dockerfile); release notes/docs reference bunx decocms.
  • CI and guards now target apps/api/** and apps/web/**; release‑tagging watches apps/api/package.json, root package.json, and scripts/build-studio.ts, and computes deploy scope (web/server/both) from changed files.
  • Tests: unit tests run via the root bun run test; the Playwright E2E suite lives in packages/e2e and its config starts apps/api and apps/web as separate webServer entries; multi‑pod, storage‑integration, resilience, and sandbox workflows follow the new layout.
  • Docs/tooling: added apps/api/README.md; refreshed README.md, AGENTS.md, TESTING.md, CONTRIBUTING.md. Worktrees/hooks now copy .env, auth-config.json, and config.json under apps/api. .gitignore and Playwright artifact paths point to apps/web.

• Migration

  • Local dev: bun run --cwd=apps/web dev (web) and bun run --cwd=apps/api dev:server (API). Build both with bun run build:studio. Run DB migrations with bun run --cwd=apps/api migrate.
  • Config moves: .env, auth-config.json, and config.json live under apps/api/.
  • Imports: replace @decocms/std and app‑local SDK paths with @decocms/shared/* (e.g. @decocms/shared/std).
  • E2E: run from packages/e2e; config starts API and web separately.
  • Deploy: API image builds from apps/api/Dockerfile; web image from apps/web/Dockerfile. The container’s SQLite path stays /app/data/mesh.db for seamless upgrades.

^{Written for commit 6dfb733. Summary will update on new commits.}