Add designlang public-shell pack; tighten auth capture checks

Ran authenticated extract against coulomb.social; session metadata
matched anonymous Bubble defaults, so treat docs/design-extract as a
public shell baseline (PROVENANCE.md). Capture script now refuses to
overwrite storage-state.json with thin anonymous sessions.

docs/design-extract/storybook/.storybook/main.ts

@@ -0,0 +1,8 @@
+import type { StorybookConfig } from '@storybook/react-vite';
+
+const config: StorybookConfig = {
+  stories: ['../stories/**/*.mdx', '../stories/**/*.stories.@(ts|tsx)'],
+  addons: ['@storybook/addon-essentials', '@storybook/addon-docs'],
+  framework: { name: '@storybook/react-vite', options: {} },
+};
+export default config;

docs/design-extract/storybook/.storybook/preview.ts

@@ -0,0 +1,10 @@
+import type { Preview } from '@storybook/react';
+import './../stories/tokens.css';
+
+const preview: Preview = {
+  parameters: {
+    backgrounds: { default: 'paper' },
+    controls: { matchers: { color: /(background|color)$/i } },
+  },
+};
+export default preview;