refactor(AppShell): pure renderer, drop browser fetch

The browser-fetching variant ran into the cross-origin / cert-trust
wall that came up the moment a real user loaded the page. Move the
network call out of the library: <AppShell> now takes a pre-resolved
ShellConfig as a required prop. Apps fetch from gsc-shell-api in
their RSC layout (server-to-server, no CORS, no cert dance) and pass
the result down.

Public surface:
  AppShell, useShell, ShellConfig + sub-types

Removed:
  ShellProvider (network logic gone), all fetcher props
  (apiUrl, getToken, appKey, initialConfig, revalidateMs).

useShell() now returns ShellConfig directly (was ShellContextValue
with loading/error/refresh — no longer relevant).

Apps drive revalidation by re-rendering; chrome stays request-fresh
without any client-side polling.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/Tooltip.tsx

@@ -4,7 +4,7 @@ import { useFloating, offset, shift, flip, arrow, Placement, Middleware } from '
 export type TooltipProps = {
   content: React.ReactNode;
   placement?: Placement;
-  children: React.ReactElement;
+  children: React.ReactElement<any>;
   className?: string;
 };