refactor(web): unify canonical state with TanStack

[GenerQAQ]

Why we need this PR?

Web state has overlapping cache, store and context owners. This consolidates server facts in TanStack Query/DB and keeps UI state in TanStack Store, with account, view and request lifecycles that govern async publication.

What changed

• Replace legacy Web cache/store/context ownership with canonical Query/DB data and scoped TanStack Store UI state.
• Qualify subscriptions, optimistic updates and async writes across navigation, reconnect and account exit; preserve existing read/unread, pagination and delivery behavior.
• Preserve forum opener archive eligibility across direct navigation, channel metadata and notify refresh. Both sidebar projections exclude the reserved archive tag, while current eligible responses and field revision guards preserve newer WS facts.
• Add and update lifecycle/DOM controls, establish cold Invite fixtures before navigation, and initialize normal local services through their existing health boundaries. Existing browser assertions and limits remain in place.
• Update Web/App Knip configuration and the workspace dependency lockfile.

Validation on 90fa60b38d20af1c917b9fe354af63b4129a8fc2: The full normal hook passes, including fresh Web unit/DOM execution: 939 files / 9243 cases. Independent pnpm typecheck and pnpm test pass; Turbo package results are cached, with fresh driver and CI-script tails. Full four-target coverage and the unchanged 206-file verifier pass. Final Codecov patch is 310/310 lines, 100%, with two complete upload sessions.

Hosted CI attempt 1 passes both gates: 247 browser cases pass and 2 are skipped; all seven original forum sidebar cases pass. Linux units pass 14860 cases with 4 skips; downstream daemon/package checks pass separately. All 28 PR checks are complete: 27 successes and 1 optional skip.

Runtime QA on this head: The first owner run has 83 passes and one failure on the initial sidebar GET; all 64 community cases pass in its whole-group rerun, with the 20 passing SSR cases retained separately. Independent 140-case QA finishes with 137 passes, one failure and two cases without final results. Its archived-opener case again receives HTTP500 on the first sidebar GET, before archive, retained, remote or refresh acceptance. The geometry invocation is interrupted after four passes, leaving two light-theme assertion chains without final results; it is not rerun. Complete QA service/data release is verified at 2026-10-03 20:28:28 +08:00. A separate local experience session is closed after its visual review is accepted. Saved-log review confirms TraceStore persistence SQLITE_BUSY errors and a business D1 non-JSON internal response; their causal relationship remains UNKNOWN. Owner-authorized focused reruns of the archived-opener case both pass: unchanged (24.5s) and with a temporary five-second pause before the initial explicit sidebar read (28.3s). All original assertions remain; both normal lifecycles fully release and the temporary test change is restored. Sidebar request records are 200 in both runs; the paused run still records two other GET500s (bots and exact channel), and each run has one primary TraceStore SQLITE_BUSY. Because the unchanged case also passes, this comparison does not establish a pause-based fix. These results are separate from the original 137/1/2; the two interrupted geometry cases remain unrerun. Native iOS is blocked by the existing host tool boundary; Android/macOS, shared-tab stale writes, combined SDK/IDB retirement and parts of non-community workspace runtime remain unverified. Weak-network gap: a first read that stays pending or initial positioning that never settles can leave the message skeleton or positioning overlay visible indefinitely. There is no common HTTP request deadline, and the current two-second positioning timer does not force unpositioned content to reveal. Cached messages alone do not guarantee visibility. This PR has not demonstrated a fix for the reported production symptom. Runtime migration acceptance remains incomplete; merge is authorized with these recorded gaps, and weak-network skeleton/initial-positioning improvements are deferred to a follow-up.

Checklist

• Tests added/updated as needed
• All CI checks pass
• PR targets the correct branch (main)
• Runtime migration acceptance complete

Impact Areas

• Shared library (@alook/shared)
• Web app (@alook/web)
• App (@alook/app) — Knip configuration only
• Email Worker (@alook/email-worker)
• WebSocket DO (@alook/ws-do)
• CI/CD
• Other: workspace dependency lockfile and static-analysis configuration

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!