feat: v0.3.0 — Phase 3/4 façades + AppLayout on AppShell

- Curated re-exports from @limitless/ui through /forms, /data,
  /feedback, /navigation, /utils sub-paths so apps stop importing
  from the lower layer.
- /forms also re-exports the full @limitless/ui validation surface
  (hooks, format/security/address validators, types).
- AppLayout is now a thin wrapper over @limitless/ui's <AppShell> —
  same ShellConfig DTO, no duplicated chrome code.
- shell/types + shell/index re-export from @limitless/ui to keep one
  canonical type and one shared context.
- auth middleware: loose NextRequestLike typing to avoid two-copies-
  of-next conflict with the consumer's next.
- postbuild: rewrite ../images/ to ./images/ in copied CSS so refs
  resolve in dist/styles/.

Widget family in /data is the intersection of limitless's two
Widget files (Widget.d.ts vs Widget/index.d.ts collision in dist);
upstream fix needed before exposing IconWidget/UserWidget/etc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/auth/middleware.ts

@@ -1,4 +1,16 @@
-import { NextResponse, type NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+// Loose local typing for NextRequest. Importing next's official type
+// here pulls in `next/server` from THIS package's node_modules, which
+// causes a "two copies of next" type conflict with the consumer's
+// next. The shape below is the surface area the middleware actually
+// uses; structural typing is enough at the call site.
+interface NextRequestLike {
+  nextUrl: URL;
+  cookies: {
+    get(name: string): { value: string } | undefined;
+  };
+}
 
 export interface AuthMiddlewareOptions {
   /**
@@ -38,7 +50,7 @@ export function createAuthMiddleware(opts: AuthMiddlewareOptions = {}) {
   const publicRoutes = opts.publicRoutes ?? [];
   const signInPath = opts.signInPath ?? "/api/auth/signin/keycloak";
 
-  return function middleware(req: NextRequest) {
+  return function middleware(req: NextRequestLike) {
     const { pathname } = req.nextUrl;
 
     if (isAlwaysAllowed(pathname)) {