feat: extract review-workspace slice into @citation-evidence/work (CWORK-WP-0001)

Establishes citation-work as the standalone home of the review workspace,
migrated out of the citation-evidence umbrella app.

- Package/tooling scaffold: package.json, tsconfig, vite/vitest/eslint configs
  with eslint-plugin-boundaries enforcing engine/anchor/source-only imports
- Providers/hooks: EngineProvider, SessionProvider + use* hooks (T02)
- Panes: CollectionList, ViewerShell, EvidenceSidebar (T03/T04/T05)
- Capture/edit: InlineCaptureForm, EvidenceFormBody; UploadDropzone owned here
- ReviewShell: repo-owned three-pane layout with an upload slot seam
- Tests: CollectionList, InlineCaptureForm capture flow, EvidenceSidebar
  export/edit/activation (11 tests, all green)
- Anchor consumed as @citation-evidence/evidence-anchor package; @source kept
  on the umbrella facade for its local viewer-url policy
- Docs (README/SCOPE) refreshed; deferred gaps recorded

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vite.config.ts

@@ -0,0 +1,49 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import { viteStaticCopy } from "vite-plugin-static-copy";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  plugins: [
+    react(),
+    viteStaticCopy({
+      targets: [
+        {
+          src: resolve(__dirname, "node_modules/pdfjs-dist/cmaps") + "/[!.]*",
+          dest: "cmaps",
+        },
+        {
+          src: resolve(__dirname, "node_modules/pdfjs-dist/standard_fonts") + "/[!.]*",
+          dest: "standard_fonts",
+        },
+      ],
+    }),
+  ],
+  resolve: {
+    alias: {
+      "@shared": resolve(__dirname, "../citation-engine/src/shared"),
+      "@engine": resolve(__dirname, "../citation-engine/src/engine"),
+      // Anchor is consumed as the standalone `@citation-evidence/evidence-anchor`
+      // package (resolved via node_modules). `@source` still points at the
+      // umbrella source façade because it owns the local `viewer-url` policy
+      // that is not part of the extracted `evidence-source` package.
+      "@source": resolve(__dirname, "../citation-evidence/src/source"),
+      "@work": resolve(__dirname, "src/work"),
+    },
+  },
+  server: {
+    fs: {
+      allow: [
+        resolve(__dirname),
+        resolve(__dirname, "../citation-engine"),
+        resolve(__dirname, "../citation-evidence"),
+      ],
+    },
+  },
+  optimizeDeps: {
+    exclude: ["pdfjs-dist"],
+  },
+});