feat(frontend): serve the new frontend at /next beside the classic UI

[VibeSWE]

Adds the new React/TypeScript frontend and serves it at /next/ beside the classic Prism UI at /, so the two can be compared on one server while features move over.

How it works

• build.rs: NEXT_ASSETS_PATH embeds a second bundle as generate_next(). Without it the function returns no files and nothing is mounted at /next. LOCAL_ASSETS_PATH and the Prism zip with the community overlay at / are unchanged.
• Server and query server: /next is registered ahead of the catch-all / route, with its own SPA fallback.
• OIDC: when OIDC isn't configured, a sign-in started from /next redirects to /next/oidc-not-configured instead of Prism's page.
• Frontend:
  • builds with base /next/ and routes under that base path;
  • sign-in and sign-out redirects keep the prefix;
  • adds a Compare in classic UI button that opens the equivalent Prism page in a new tab, and a Classic UI sidebar group linking to Alerts, Users and Roles.
• Builds: the Dockerfiles, build/release/coverage workflows and Cross.toml build the frontend with Node 24 and set NEXT_ASSETS_PATH. A new frontend.yaml workflow runs the frontend checks.
• .gitignore: excludes *.pem and pr-*.md notes.

Both UIs share one origin, so a single sign-in (native or OIDC) works in both. When the frontend reaches parity, it moves to / and the /next mount, the community overlay and the classic UI links are removed (see frontend/README.md).

Validation

• cargo fmt --check; cargo clippy --locked -- -D warnings with and without NEXT_ASSETS_PATH: pass
• cargo test --lib -- oidc oauth rbac: 21 passed
• Frontend: format check, production build, 44 unit tests, 33 app browser tests and 14 Storybook browser tests: pass
• Local-store server with NEXT_ASSETS_PATH:
  • / and /logs serve Prism; /next, /next/ and deep links serve the new frontend, and its JS assets load.
  • In Chromium: signing in at /next/login returns to the requested page; the classic Users page opens already signed in; signing out returns to /next/login; no page errors.
• Not run: Docker image builds, and an end-to-end OIDC sign-in through a real provider.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[comment-clanker]

Review: serve the new frontend at /next

The server side is small and reads well. configure_ui registers /next before the catch-all /, and a build without NEXT_ASSETS_PATH keeps today's behaviour. The /next routing, the base-path helpers in auth.ts and the CI wiring also look correct. Inline comments cover the live browser suite, which still targets root paths, plus test coverage and CI cleanup.

Smaller notes

• LOCAL_ASSETS_PATH builds now report UI_VERSION=local instead of development from /about (build.rs). That's fine, but the PR description doesn't mention it.
• frontend/README.md still says the check passed 36 unit tests. The PR description says 44.
• frontend/docs/ adds about 2.2 MB of parity screenshots and page-text dumps, plus internal notes (validation-review.md, component-design-review.md, wiki-drafts/). Should these live in the wiki or a PR artifact instead of the tree?