## Why

The backend API is fully scaffolded with domain models, routers, and authentication dependencies, but the frontend remains a static scaffold page (FN-002). Users cannot sign in, view projects, or interact with any backend functionality. This change delivers the foundational frontend architecture needed to unlock all user-facing MVP features.

## What Changes

- **Authentik OIDC integration**: Auth provider with login/logout flow, token management, and automatic user provisioning
- **Dashboard shell**: Responsive layout with header, navigation sidebar, and main content area
- **Navigation routes**: Dashboard, Projects, Repositories, Tools, Settings pages with React Router
- **Typed API client**: Generated or hand-written client for all `/api/v1/*` endpoints
- **Project list UI**: Display user's projects with create/edit capabilities
- **Environment config layer**: Vite env var integration for API URL, auth endpoints
- **Auth-guarded routes**: Redirect unauthenticated users to login

## Capabilities

### New Capabilities
- `auth-oidc`: Authentik OIDC authentication flow, token storage, session management
- `dashboard-shell`: Responsive layout with navigation, header, and content area
- `project-management-ui`: Project list, create, edit, delete views
- `api-client`: Typed HTTP client for backend API consumption
- `route-guards`: Authentication-based route protection and redirects

### Modified Capabilities
- None (this is purely additive to the existing scaffold)

## Impact

- **apps/web/src/**: All new frontend code
- **apps/web/package.json**: New dependencies (react-router-dom, @tanstack/react-query, etc.)
- **apps/api/app/auth/dependencies.py**: CORS and auth flow alignment
- **docs/development.md**: Updated frontend development instructions