Spaces: one Harbor client for the desktop and the phone

[ramnique]

First step of the Spaces web-app plan: the Harbor client moves into one package every app can use.

What changes

• New package @x/spaces-client (apps/x/packages/spaces-client): the REST client and the live socket, moved from packages/core/src/spaces/ with their tests. Git tracks them as renames.
• Core, the desktop main process, and rowboat-server import it. Core's spaces/index.ts no longer re-exports the client.
• The phone's copy is gone. lib/spaces/live.ts is deleted. lib/spaces/client.ts drops from 587 lines to a subclass that passes expo-crypto's SHA-256, so the 14 places that construct a client didn't change.
• The merged client has every method from both copies. That's core's newer methods (agents, invocations, approvals, transport-failure reporting) plus the phone's profile-image and push methods, which now use the protocol's routes.
• It runs anywhere fetch, WebSocket, and WebCrypto exist.
  • The blob hash uses WebCrypto by default instead of node:crypto.
  • The default fetch is called unbound. A browser throws "Illegal invocation" when fetch is called as a method of another object.
  • Blob and image uploads share one bytes-PUT path, and every response goes through one contract check.
• Wiring: root deps/test/typecheck scripts, the Forge build hook, and the phone's eas-build-post-install all build the package. The lockfile adds only the new importer.

What the phone notices

• A failed fetch is now a SpacesRequestError with code unreachable, as on desktop. The offline banner (isNetworkError) checks that code.
• Responses from profile-image routes are now checked against the contract.
• space_removed frames now reach member handlers. The phone registers none today.

Desktop behavior is unchanged.

Verified locally

• npm run typecheck (apps/x) passes. tsc --noEmit passes for main.
• npm test (apps/x) passes: shared 321, spaces-client 34, core 1024, server 29, renderer 1152.
• apps/main npm run build: the main process and rowboat-server bundle with esbuild.
• The phone: expo export --platform ios bundles with Metro.
  • tsc on the phone reports two errors from missing CSS typings, in files this PR doesn't touch. The cause is Expo's generated expo-env.d.ts, which is absent in a fresh checkout.
  • Not run on a device.

🤖 Generated with Claude Code