feat(react)!: adopt provider target attachments (#68)

## Summary

Adopt the credential-scoped provider connection and explicit
provider-target attachment contract in `@domainkit/react`. Existing
connections now expose discovered targets for selection without another
authentication round trip, while integration authentication remains
distinct from OAuth.

## API

```ts
const reusableConnection: Transport.ReusableConnection = { connection, targets };

controller.attach(reusableConnection, target);
// -> transport.connection.attach({ connectionId, domain, target })
// -> Connected { connection, attachment, provider }
```

Detach is attachment-scoped and preserves DNS:

```ts
transport.connection.detach({ attachmentId, preserveDns: true });
// -> Detached { attachment, connection, remainingAttachments }
```

## UI states

```text
inspect domain
  -> reusable connections + credential-scoped targets
  -> unique target: attach
  -> ambiguous targets: user selects one
  -> unavailable targets: explain why attachment is unavailable
  -> connected: provision, verify, or detach the exact attachment
```

The workshop keeps its per-story controls at the bottom and places
theme/color-scheme controls in the canvas toolbar. Action geometry
remains stable while lifecycle feedback is emitted to the host.

## Screenshots


![domainkit-react-ambiguous-samva.png](https://scratchpad.arya.sh/f/01a055cc-8163-704a-99db-a5da4ee1494b/domainkit-react-ambiguous-samva.png)


![domainkit-react-ambiguous-samva-dark.png](https://scratchpad.arya.sh/f/01a055cc-84a3-78bf-b28f-862de6dfbfc5/domainkit-react-ambiguous-samva-dark.png)


![domainkit-react-detached-neutral.png](https://scratchpad.arya.sh/f/01a055cc-8883-7245-b547-93054a9160ec/domainkit-react-detached-neutral.png)

## Validation

- `DOMAINKIT_WORKSHOP_PORT=4184 bun run release:check`
- 27 core test files / 147 tests
- 9 React test files / 67 tests
- 26 Playwright browser tests

## Follow-up Scope

- Provider credentials, server authorization, package publication,
deployment, and DNS mutation remain host-owned and out of scope.