CI guardrail: block app-logic imports from leaking into packages/ui-kit

[JSONbored]

Context

The entire point of packages/ui-kit is that it's a real, standalone, dependency-free library — the moment a component inside it imports something app-specific (@tanstack/react-router, @tanstack/react-query, an apps/ui-local hook, context, or API-client type), the extraction has silently regressed back into the exact problem this epic exists to fix, just one directory over. Nothing in the migration issues (#D/#E/#F) structurally prevents that from creeping back in over time without an enforced boundary.

Depends on #B (scaffold) landing so there's a real package to lint; should land no later than the first migration PR (#D) so the boundary exists from day one rather than being bolted on after violations accumulate.

Requirements

• Add an ESLint rule (e.g. eslint-plugin-import's no-restricted-paths, or a custom rule) scoped to packages/ui-kit/src/** that fails on any import of @tanstack/react-router, @tanstack/react-query, or anything resolving into apps/ui/**.
• Wire this into the existing npm run lint / CI job so a violation fails the PR the same way any other lint error does — no separate opt-in step.
• Add a short note to packages/ui-kit's README (or root CLAUDE.md/AGENTS.md contributor guide) stating the boundary rule in plain language, so it's discoverable without reading the ESLint config.
• Confirm the rule actually fires: add a temporary intentional violation in a throwaway branch, confirm CI red, then remove it — don't just trust the config compiles.

Deliverable

A merged PR adding the lint rule + CI wiring + a documented one-line statement of the boundary, verified to actually catch a violation.

Expected outcome

packages/ui-kit stays a real, portable library indefinitely — the boundary is enforced by tooling, not by convention or memory.

[linear-code]

JSO-3645

[JSONbored]

Part of #4867.