feat(03-01): stand up web/ npm workspace with Wave-0 hand-rolled test runner (D-01, D-02, D-11, D-14)

- web/ workspace: TS + Vite shell (maplibre-gl 6.15.0, vite 8.3.5, TS 5.9.3; no UI framework, no Telegram SDK script tag)
- tsconfig mirrors bot/ strictness byte-for-byte except the three authorized keys (DOM lib, vite/client types, resolveJsonModule)
- test/runner.mjs + harness.mjs copied verbatim from bot/test/ (body-identical past header)
- root package.json: web workspace + web:* delegate scripts
- web/src/main.ts entry module created (tsc include:['src'] needs ≥1 input; 03-02/03-03 mount here)

web/src/main.ts

@@ -0,0 +1,10 @@
+/*
+ * main.ts — the Mini App entry module (D-01, D-02, D-11).
+ * --------------------------------------------------------
+ * The one-and-only DOM entry: web/index.html loads it as `type="module"`
+ * into `<div id="app">`. This plan (03-01) scaffolds the workspace; the
+ * Telegram WebApp binding behind the narrow TelegramWebAppLike interface
+ * and the map shell mount here in plans 03-02 and 03-03. Kept
+ * dependency-free until those plans introduce their modules.
+ */
+export {};