feat(web): patient web app with ЕМИАС (demo) and anonymous sign-in

A second channel to the same dialog engine as the Telegram bot: consent,
onboarding, scales and check-ins come from app/dialog; the bot is unchanged.

- API: /auth/emias (doctor's one-time connect code via EmiasMock),
  /auth/emias/demo (synthetic personas), /auth/anonymous (random token,
  nothing stored in the identity DB), /crisis/resources from crisis.yaml
- web/: React + TS + Vite, mobile-first, safe areas, hash routing,
  tokens and texts isolated for a Capacitor mobile build

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/api/client.ts

@@ -0,0 +1,42 @@
+import type { AuthResult, CrisisResource, DemoPersona, DialogEvent, Reply } from "./types";
+
+// Web: same-origin /api/v1 (Vite proxy in dev). Mobile shell: set VITE_API_BASE to the absolute API URL at build.
+const BASE: string = import.meta.env.VITE_API_BASE ?? "/api/v1";
+
+export class ApiError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+async function request<T>(path: string, init?: RequestInit): Promise<T> {
+  let res: Response;
+  try {
+    res = await fetch(`${BASE}${path}`, {
+      ...init,
+      headers: { "Content-Type": "application/json", ...init?.headers },
+    });
+  } catch {
+    throw new ApiError(0, "network");
+  }
+  if (!res.ok) throw new ApiError(res.status, res.statusText);
+  return (await res.json()) as T;
+}
+
+const post = <T>(path: string, body?: unknown) =>
+  request<T>(path, { method: "POST", body: body === undefined ? undefined : JSON.stringify(body) });
+
+export const api = {
+  signInEmias: (code: string) => post<AuthResult>("/auth/emias", { code }),
+  signInEmiasDemo: (personaToken: string) => post<AuthResult>("/auth/emias/demo", { persona_token: personaToken }),
+  signInAnonymous: () => post<AuthResult>("/auth/anonymous"),
+  demoPersonas: () => request<DemoPersona[]>("/demo/personas"),
+  crisisResources: () => request<CrisisResource[]>("/crisis/resources"),
+  sendEvent: async (token: string, event: DialogEvent) =>
+    (await post<{ replies: Reply[] }>(`/dialog/${encodeURIComponent(token)}/events`, event)).replies,
+  outbox: async (token: string) =>
+    (await request<{ replies: Reply[] }>(`/dialog/${encodeURIComponent(token)}/outbox`)).replies,
+};