Add on-page editor for the go-graph-cms

Injectable React editor that is side-loaded onto the statically rendered
page and edits through the CMS HTTP API (POST /api/edit).

- Shadow-root UI over server HTML; patches morphed in, undo/redo from
  server inverses (reuses @k6n/cms-editor EditClient/morph/markdown editor)
- Sign-in via go-auth device grant as the CMS client (aud matches), token
  refresh + 401 retry; live preview swapped in on load and on tab focus
- Schema-driven property form (arrays, maps, variants, $ref, validation)
- Every string property editable where it is rendered (value-bound inline
  fields and attribute chips), markdown WYSIWYG for marked fields
- Block palette + drag & drop with ghost drop targets, insertion slots,
  sort snapping between siblings (Alt to nest)
- x-style annotations: on-page padding/margin/gap handles, Style panel,
  wrap-in-layout; x-graph label/group for titles and grouping
- Dev workflow: Vite proxy to the live site (token injected server-side)
  or an offline in-memory mock CMS; jsdom test suite

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,18 @@
+# Which CMS the dev server talks to:
+#   live (default) - proxy everything to CMS_TARGET (page HTML is fetched server-side and the editor is injected)
+#   mock           - fully offline: in-memory CMS + fixture page (same as `npm run dev:mock`)
+CMS_MODE=live
+CMS_TARGET=https://k6n.net
+
+# Auth for the dev proxy. The proxy adds these to every upstream request, so the
+# secret never reaches the browser or the bundle. Use ONE of:
+#   CMS_TOKEN   - an OIDC/device-flow JWT          -> Authorization: Bearer <token>
+#   CMS_API_KEY - a minted key with write scope    -> X-API-Key: <key>
+#   CMS_COOKIE  - the admin session cookie string  -> Cookie: <value>
+# Easiest: log in to the backoffice, copy `accessToken` from localStorage['auth.tokens'].
+CMS_TOKEN=
+CMS_API_KEY=
+CMS_COOKIE=
+
+# Location of the shared @k6n/cms-editor package sources (EditClient, morph, markdown editor).
+CMS_EDITOR_SRC=../ecommerce/backoffice/web/packages/cms-editor/src