feat(design): design lab + DESIGN.md skeleton (E28 S2a)

- docs/DESIGN.md: the written source of truth for the UI. Decided chapters
  (principles, device adaptation, action placement, text stays selectable,
  interaction rules, copy, anti-patterns, decision log); controls and
  surfaces are marked Pending until the owner picks from the lab.
- /design-lab (dev only): renders each open decision's variants with the
  app's real CSS, themes and font scale. Batch A = six control decisions.
- devOnlyGuard: a production build fails if anything under src/design-lab
  reaches the bundle (seen red with an unguarded import).
- Size contract: tablet portrait + landscape and up, replacing the
  1024x768 floor with its never-built "too small" message.

frontend/vite.config.ts

@@ -1,5 +1,6 @@
 import { defineConfig } from "vite";
 import { reactWithCompiler } from "./reactPlugin";
+import { devOnlyGuard } from "./devOnlyGuard";
 
 // During `vite dev` (host with Node), proxy API calls to the backend container.
 // Use 127.0.0.1 (not "localhost") so Node doesn't resolve to IPv6 ::1, which the
@@ -20,7 +21,7 @@ const proxy = {
 };
 
 export default defineConfig({
-  plugins: [reactWithCompiler()],
+  plugins: [reactWithCompiler(), devOnlyGuard()],
   server: { port: 5173, proxy },
   build: { outDir: "dist" },
 });