feat(web): deploy SPA to GitHub Pages on push to main

[paperhurts]

Summary

• New `.github/workflows/deploy-web.yml`: on every push to `main` that touches `packages/web/`, `packages/core/`, the workflow itself, or the lockfile, build the web SPA and deploy to GitHub Pages.
• Uses the canonical `actions/configure-pages@v5` → `upload-pages-artifact@v3` → `deploy-pages@v4` chain with the minimum permissions (`pages: write`, `id-token: write`, `contents: read`).
• Concurrency-grouped on `pages` with `cancel-in-progress: true` so a flurry of merges produces one deploy at a time.
• Adds a "Try the web UI" section to root README pointing at `https://paperhurts.github.io/gitmarks/\`.
• Pages source is already configured to `workflow` via the API (`POST /repos/paperhurts/gitmarks/pages build_type=workflow`); the first deploy fires the moment this PR merges.

Also re-applies the stale doc updates that were dropped during the PR #40 merge: test counts 286→290 / 100→104; expanded URL-safety and CSP invariants in CLAUDE.md.

Test plan

• Local build green: `pnpm --filter @gitmarks/web build` emits relative-base assets (`base: "./"` in vite.config.ts) suitable for any subpath including `/.github.io/gitmarks/`.
• CSP injection plugin scoped to `apply: "build"` so the deployed HTML carries the strict meta CSP.
• After merge: workflow runs green; `https://paperhurts.github.io/gitmarks/\` loads and redirects to `#/setup`.
• After deploy: paste a real PAT against a real bookmarks repo, walk list / search / tag / sign-out flows.

Notes

• Hash routing (`createHashRouter`) means no special server-side fallback is needed for GH Pages.
• The CSP `connect-src https://api.github.com\` allows the only network call the SPA makes.

🤖 Generated with Claude Code