feat(ui): scaffold the codegraph ui viewer as a Svelte 5 + Vite workspace (CG-40)

Adds `ui/` as an npm workspace (Svelte 5.56 + Vite 7, devDependencies only —
the engine's runtime dependencies are untouched) and chains its build into
`npm run build`, so the browser viewer ships inside `dist/` with everything
else: `build-bundle.sh` already copies `dist` wholesale and `pack-npm.sh`
packs that bundle.

Output is `dist/viewer/`, NOT `dist/ui/`: `src/ui/` is the engine's terminal
ui (shimmer progress + its worker) and tsc compiles it to `dist/ui/`, so
emitting there both deletes those modules — the CLI then dies at startup with
`Cannot find module '../ui/shimmer-progress'` — and would leave the static
server handing out compiled engine internals. The design spec is corrected to
match.

`scripts/check-ui-build.mjs` is the release guard: index.html must exist, be
non-trivial, and every local asset it references must be on disk, and the
compiled engine next door must still be intact. It runs after every UI build,
again in `build-bundle.sh` once the bundle stage has copied `dist`, and again
in `pack-npm.sh` once each archive is unpacked — so a broken viewer fails the
release instead of shipping a CLI that serves a 404.

`vite build` does not override an ambient NODE_ENV, so a shell or runner with
NODE_ENV=development silently shipped dev-mode Svelte (~13 kB of dev-only
runtime checks, warning in the user's console). The config now pins production
for `command === 'build'`; macOS and Windows ARM64 then emit byte-identical
bundle hashes.

The shell itself follows docs/design/codegraph-ui-design-spec.md §2–§3.1:
design tokens as CSS custom properties (light on bare `:root`, dark under both
`prefers-color-scheme` and `[data-theme="dark"]`), square corners, hairline
rules, one oxblood accent; top bar 48px / trail bar 34px / main; a hash router
over `#/s/<id>`, `#/file/<path>`, with `#/map` and `#/flow` reserved for phase
2. Fonts are vendored through @fontsource rather than fetched, so a local
reader works offline and never announces the project to a CDN.

Verified: clean `npm run build` from an empty dist on macOS and on the Windows
ARM64 VM (forward-slash asset URLs, CLI still starts, both assertion failure
modes exit 1); `dist/viewer` present in a real darwin-arm64 bundle and in the
packed npm platform package; shell geometry, tokens, all seven routes, both
themes and font loading checked in headless Chromium with no console errors;
`npm test` unaffected.

ui/src/lib/kinds.ts

@@ -0,0 +1,50 @@
+/**
+ * Kind glyphs — design spec §2.3.
+ *
+ * A 16x16 hollow square with a mono letter. Container/type kinds get a
+ * --press fill so a class reads as a box and a function as an outline.
+ */
+
+/** NodeKind values the engine emits (src/types.ts). */
+export const KIND_LETTER: Record<string, string> = {
+  function: 'ƒ',
+  method: 'm',
+  class: 'C',
+  interface: 'I',
+  struct: 'S',
+  type_alias: 'T',
+  enum: 'E',
+  enum_member: 'e',
+  constant: 'k',
+  variable: 'v',
+  property: 'p',
+  field: 'p',
+  file: '≡',
+  route: 'R',
+  component: '⟨⟩',
+  namespace: 'N',
+  module: 'M',
+  trait: 'Tr',
+  union: 'U',
+  protocol: 'P',
+  // Beyond the spec's list, but the engine emits them and a rail row must
+  // never render a blank box. Two lowercase letters, like `Tr`.
+  parameter: 'pm',
+  import: 'im',
+  export: 'ex',
+};
+
+/** Kinds drawn with a --press fill (they contain other symbols, or are types). */
+export const FILLED_KINDS = new Set(['class', 'interface', 'struct', 'type_alias', 'trait', 'protocol', 'union', 'enum']);
+
+/** Empty string for an unknown kind — the glyph is then a plain hollow box. */
+export function kindLetter(kind: string | null | undefined): string {
+  if (!kind) return '';
+  return KIND_LETTER[kind] ?? kind.slice(0, 1).toUpperCase();
+}
+
+/** Human wording for the kind, as shown next to a symbol's name. */
+export function kindWord(kind: string | null | undefined): string {
+  if (!kind) return 'symbol';
+  return kind.replace(/_/g, ' ');
+}