pnpm workspace, two apps, and env-only configuration

The template is now a pnpm workspace. apps/web serves Vercel and Docker. apps/cloudflare serves Workers. Encrypted admin settings are removed.

The template is a pnpm workspace with Turborepo. Shared behavior lives in @musemvp/* packages. Page code is copied between the two apps and checked by pnpm apps:parity.

Apps

apps/web is the Node app for Vercel and Docker. Set the Vercel Root Directory to apps/web.
apps/cloudflare is the Workers app. Deploy with pnpm cf:deploy.
DATABASE_CONNECTION_STRATEGY is gone. The Node app uses a pooled driver. The Workers app uses Hyperdrive per request.

Configuration

Payment, storage, Turnstile, and newsletter signing are environment variables.
/app/admin/settings and MUSE_SETTINGS_SECRET are removed. Migration 0002_drop_app_settings.sql drops app_setting and app_setting_revision.
pnpm muse:settings:export prints env lines from old encrypted rows.
pnpm muse:init and pnpm muse:doctor set up a local app.

Tests

Package tests live next to each package. Coverage floors can only rise.
pnpm test:e2e covers the Node app. pnpm test:e2e:cf covers the Cloudflare app.