docs: update specs for react migration

[Scr4tch587]

What changed

• SPEC-frontend.md: rewritten for the React stack — React 19 + TS + Vite + Tailwind v4 + shadcn/ui under bun, new file structure, TanStack Query data layer, the API-key dialog/localStorage auth flow (with the XSS caveat noted), and the GitHub Pages deployment section with its two manual setup steps. Also removes the stale claim that the frontend is built into Docker and served by nginx — nothing in `infra/` serves the frontend; Caddy only proxies the API. Ends with a "Planned" note for the create-dataset UI (blocked on the backend trust-model decision)
• SPEC-backend.md: new "CORS" section documenting `CORS_ALLOW_ORIGINS`, the default origins, middleware ordering (preflights short-circuit before auth), and that auth semantics are unchanged. The auth "Clients" paragraph no longer says the browser sends no key — it now prompts for one

Why

AGENTS.md requires spec files to track code changes; this is the final PR of the React migration stack (#374–#378).

🤖 Generated with Claude Code

[github-actions]

• main
  • feat: replace svelte frontend with react + tailwind scaffold #375
    • feat: typed api client and api key handling #376
      • feat: dataset browsing ui #377
        • ci: deploy frontend to github pages #378
          • docs: update specs for react migration 👈