Restructure world packages, add SPA defaults registry, fix create-house race

[khanhduyvt0101]

Summary

• Contract package restructured into a router-as-folder layout (lib/router/{me,workspace} → lib/router/workspace/{index,sync}.ts), createWorldClient renamed to createClient, dead me procedure + createWorldQuery helper removed, wildcard ./router/* subpath added so TS composite-mode declaration emit can portably name inner router types.
• Server package swapped to namespace imports (import * as definition from "@openkitten/world-contract", import * as router from "~/lib/router") so adding a new router file flows through every consumer with no edits; new lib/types.ts + ./types subpath for SPA-facing types; is-personal-house.ts returns false instead of throwing on missing workspace, fixing the create-house failure where better-auth's beforeAddMember hook fired before afterCreateOrganization had provisioned the workspace row, leaving orphan house rows that surfaced as ORGANIZATION_ALREADY_EXISTS on retry.
• SPA package now has apply-defaults.ts invoked from entry.client.tsx registering mutation defaults for every better-auth org operation and query defaults for workspace.sync, orgQueryKeys.list, and a 60s staleTime on the session key. lib/org-query-keys.ts is a scope tree (all/list/full/members/invitations/invitation) and lib/org-mutation-keys.ts carries the mutation scopes (organizations/active) so registry components and our defaults invalidate the same cache. sessionQueryOptions.queryKey aligned to ["auth", "getSession", null] to match @better-auth-ui/react, dropping /auth/get-session traffic from 8 to 2 calls per nav. start-auth-session-sync.ts only invalidates when the session id actually changes (was: refetch + avalanche-invalidate on every $sessionSignal).
• formatError consolidated into getErrorMessage in @openkitten/world-util; lib/format-error.ts deleted; every caller migrated. New helper handles Error / string / nested {error: {message}} / top-level {message} / falls back to "Something went wrong".
• Component-vs-lib rule documented in the SPA README: components/ is for registry-generated output (shadcn, better-auth-ui); custom components live under lib/ (flat for multi-route, lib/<route>/<component>.tsx for single-route, function files always flat). New lib/query-error-alert.tsx codifies the data-fetching pattern with retry.
• File renames matching export names: lib/active-organization-id.ts → get-active-organization-id.ts, auth-session-sync.ts → start-auth-session-sync.ts, utils.ts → cn.ts.
• Dep bumps (all minor/patch): server's nodemailer/react-email/@react-email/ui; spa's @mantine/hooks/@tanstack/react-query/@tanstack/react-query-devtools/lucide-react/recharts/jsdom/shadcn; spa adds @orpc/tanstack-query.

Test plan

• bun --bun tsc --build clean
• bun run --workspaces --if-present test — every world package green: world-contract 13, world-util 27, world-client 6, world-server 92, world-spa 580
• 100% coverage held across statements / branches / functions / lines
• bun --bun biome check packages/world reports 0 errors (22 pre-existing warnings in registry test files left alone)
• Manual smoke in Chrome at / → /workspace/members → Create house → Update name → Update slug → Invite member → Delete house → Sign-out, all flows render correctly with no orphan DB rows
• Verify /auth/get-session request count on hard reload is 2 (one TanStack, one nanostore)

🤖 Generated with Claude Code