feat: v0.3.0 — Phase 3/4 façades + AppLayout on AppShell

- Curated re-exports from @limitless/ui through /forms, /data,
  /feedback, /navigation, /utils sub-paths so apps stop importing
  from the lower layer.
- /forms also re-exports the full @limitless/ui validation surface
  (hooks, format/security/address validators, types).
- AppLayout is now a thin wrapper over @limitless/ui's <AppShell> —
  same ShellConfig DTO, no duplicated chrome code.
- shell/types + shell/index re-export from @limitless/ui to keep one
  canonical type and one shared context.
- auth middleware: loose NextRequestLike typing to avoid two-copies-
  of-next conflict with the consumer's next.
- postbuild: rewrite ../images/ to ./images/ in copied CSS so refs
  resolve in dist/styles/.

Widget family in /data is the intersection of limitless's two
Widget files (Widget.d.ts vs Widget/index.d.ts collision in dist);
upstream fix needed before exposing IconWidget/UserWidget/etc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/forms/index.ts

@@ -1,2 +1,146 @@
-// @gsc/web-kit/forms — Phase 1 stub. Real surface lands in later phases.
-export {};
+/**
+ * @gsc/web-kit/forms — form primitives + validation.
+ *
+ * Curated re-export from @limitless/ui. Apps import everything here
+ * instead of reaching into the lower layer:
+ *
+ *   import { Form, FormGroup, FormControl, Select, SelectSingle,
+ *            useValidation, required, email } from "@gsc/web-kit/forms";
+ */
+
+// Form primitives
+export {
+  FormGroup,
+  FormControl,
+  FormCheck,
+  Select,
+  InputGroup,
+} from "@limitless/ui";
+export type {
+  FormGroupProps,
+  FormControlProps,
+  FormCheckProps,
+  SelectOption,
+  SelectProps,
+  InputGroupProps,
+} from "@limitless/ui";
+
+// Rich selects (react-select family — AdvancedSelect module)
+export {
+  SelectSingle,
+  MultiSelect,
+  TagsSelect,
+  AsyncSelect,
+} from "@limitless/ui";
+export type {
+  SelectSingleProps,
+  SelectMultiProps,
+  CreatableSelectProps,
+  AsyncSelectProps,
+} from "@limitless/ui";
+
+// Rich inputs
+export {
+  DatePicker,
+  ColorPicker,
+  TagInput,
+  FileUpload,
+  Slider,
+  Rating,
+  DualListBox,
+  ImageCropper,
+} from "@limitless/ui";
+
+// Multi-step
+export { Wizard, Stepper } from "@limitless/ui";
+
+// Validation — hooks (re-exported via @limitless/ui root: `export * from './validation'`)
+export {
+  useValidation,
+  useFieldValidation,
+  useAddressAutocomplete,
+  loadGoogleMapsScript,
+} from "@limitless/ui";
+
+// Validation — format validators
+export {
+  required,
+  minLength,
+  maxLength,
+  pattern,
+  matches,
+  email,
+  url,
+  tel,
+  number,
+  range,
+  date,
+  time,
+  datetimeLocal,
+  month,
+  week,
+  color,
+  search,
+  password,
+  getPasswordStrength,
+  file,
+  checkbox,
+  radio,
+} from "@limitless/ui";
+
+// Validation — security
+export {
+  noInjection,
+  noSqlInjection,
+  noScriptInjection,
+  noHtmlInjection,
+  noPromptInjection,
+  detectInjectionType,
+  SQL_INJECTION_PATTERNS,
+  SCRIPT_INJECTION_PATTERNS,
+  HTML_INJECTION_PATTERNS,
+  PROMPT_INJECTION_PATTERNS,
+} from "@limitless/ui";
+
+// Validation — address
+export {
+  postalCode,
+  europeanPostalCode,
+  city,
+  streetAddress,
+  houseNumber,
+  europeanCountry,
+  europeanAddress,
+  getCountryName,
+  getPostalCodeHint,
+  POSTAL_CODE_PATTERNS,
+  EU_COUNTRIES,
+  EEA_COUNTRIES,
+  EUROPEAN_COUNTRIES,
+} from "@limitless/ui";
+
+// Validation — types
+export type {
+  ValidationStatus,
+  ValidationResult,
+  FieldState,
+  FormState,
+  ValidatorFn,
+  FieldSchema,
+  FormSchema,
+  EuropeanAddress,
+  AddressSuggestion,
+  SecurityValidationOptions,
+  PasswordStrength,
+  PasswordOptions,
+  PhoneOptions,
+  NumberOptions,
+  DateOptions,
+  TimeOptions,
+  FileOptions,
+  UseValidationOptions,
+  UseFieldValidationOptions,
+  UseAddressAutocompleteOptions,
+  ServerValidationSchema,
+  ServerValidationResult,
+} from "@limitless/ui";