feat(design-system): establish independent UI foundation

[GCWing]

Summary

• Add the independent design-system workspace with design tokens, BitFun themes, reusable UI packages, package contracts, and Design Lab.
• Migrate Web UI Button and Switch ownership to @bitfun/ui, introduce the shared TabGroup/scene navigation foundation, and connect product Appearance values through a semantic token projection bridge.
• Remove superseded Web UI component implementations and stale Appearance parts, while preserving legacy Appearance package compatibility at the reader boundary.
• Correct dangerous-action semantics across notifications, Appearance workflows, and destructive actions.

Fixes: N/A

Type and Areas

Type: Feature / refactor / UI/UX / docs / test

Areas: design system, web UI, Appearance/theme infrastructure, scene shell, repository tooling

Motivation / Impact

This establishes a package-owned design-system foundation instead of continuing to duplicate control anatomy and styling inside the product Web UI. Product-specific Appearance remains in the Web UI adapter layer, while @bitfun/ui owns reusable component anatomy and behavior.

The change was reviewed for redundancy: legacy Button/Switch implementations and obsolete Appearance action parts were removed rather than kept as parallel owners. Compatibility migration drops retired surfaces from older persisted Appearance packages instead of rejecting those packages after upgrade.

Verification

Completed before the final rebase:

• pnpm run design-system:check — passed (package builds, Design Lab build, 64 tests)
• pnpm run theme:color-audit:all — passed
• pnpm run appearance:contract-audit — passed
• pnpm run i18n:audit — passed
• pnpm run motion:audit — completed; only the existing PortForwardDialog intent reminder was reported
• Focused Vitest run covering all 22 changed/new Web UI test files — 90/90 passed
• git diff --check — passed

Known baseline:

• pnpm run type-check:web remains blocked by the pre-existing websocket-adapter.ts(21,3) error: GitTrustReport is not exported from @/generated/api; the failing file is outside this diff.

Skipped by request:

• No post-rebase test rerun
• No E2E validation
• No browser automation or rendered visual QA
• Remote workspace, remote control, Peer Device Mode, and Detached Dispatch scenarios were not exercised

Reviewer Notes

• The UI package does not consume or implement the Web UI Appearance schema. Web UI owns the semantic token projection bridge.
• Button danger is modeled as an orthogonal tone="danger", so destructive meaning is preserved across visual variants.
• Build/test evidence above is not a rendered visual-fidelity claim.
• AI-assisted implementation and review.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.