feat(web): add authenticated file workflow

- feat: connect login and logout to the REST API with session-scoped tokens, protected routing, single-flight refresh, and authenticated query cache cleanup.
- feat: add the Ant Design application shell with root file listing, pagination, small-file upload, and authenticated download.
- test: cover session storage and API retry and error behavior with Vitest.
- docs: document the browser milestone, same-origin API topology, and deferred transfer and account features.

web/README.md

@@ -4,15 +4,44 @@ MyGO's browser client is a pure client-side rendered application built with Reac
 
 ## Development
 
+Install the repository-pinned Go and Node.js versions from the repository
+root:
+
 ```bash
-npm install
-npm run dev
+mise install
 ```
 
+Start the Go API from the repository root:
+
+```bash
+mise exec -- go run . serve
+```
+
+Create a development account through the existing public API if needed:
+
+```bash
+curl --request POST http://127.0.0.1:10086/api/v1/auth/register \
+  --header 'Content-Type: application/json' \
+  --data '{"username":"web-user","email":"web@example.com","password":"password123"}'
+```
+
+Then start the browser client from `web/`:
+
+```bash
+mise exec -- npm ci
+mise exec -- npm run dev
+```
+
+Vite proxies `/api` to `http://127.0.0.1:10086`. Production deployments must
+serve the static build and `/api/v1` from the same origin, normally through a
+reverse proxy.
+
 ## Checks
 
 ```bash
-npm run check
+mise exec -- npm run check
 ```
 
-The production build is emitted to `dist/` as static assets. See `docs/web/roadmap.md` at the repository root for architecture boundaries and planned dependencies.
+The production build is emitted to `dist/` as static assets. See
+`docs/web/roadmap.md` at the repository root for architecture boundaries and
+planned dependencies.