ui: shadcn-ui + React island shells for pages, Redis session store

Rewrite the dashboard, machines, users, dns, and settings pages as thin
Astro shells that mount a matching React island (Dashboard, MachinesPage,
UsersPage, DnsPage, SettingsPage) built on the shadcn-ui component
library. Alpine.js templates in those pages are replaced wholesale;
Alpine still ships as the runtime for the ACL editor's dependencies.

- src/components/ui/*: shadcn primitives (button, card, tabs, select,
  dropdown-menu, avatar, badge, input, switch, separator)
- src/components/{dashboard,dns,machines,settings,users}/*: page-level
  React shells that consume server props from the Astro parent
- src/components/shell/AppShell.tsx: shared chrome (nav, user menu)
- src/lib/utils.ts: shadcn's cn() helper
- src/lib/auth/session-manager.ts: pluggable SessionStore interface with
  Redis (via REDIS_URL) or in-memory backends; both honor absolute
  expiration via TTL. In-memory logs a warning that sessions vanish on
  restart.
- src/lib/auth/oidc-client.ts, oidc-state.ts: shrink OIDC handlers now
  that PKCE + nonce state travels in a signed JWT cookie
- src/pages/api/auth/*: match the simplified handlers
- src/styles/global.css, tailwind.config.mjs, tsconfig.json: shadcn
  design tokens and the '@/*' path alias
- docker-compose.local.yml: local dev tweaks
- package.json, pnpm-lock.yaml: shadcn + Radix + ioredis + zod

package.json

@@ -27,16 +27,27 @@
 		"@astrojs/tailwind": "^5.1.2",
 		"@kubernetes/client-node": "^1.3.0",
 		"@libsql/client": "0.15.12",
+		"@radix-ui/react-avatar": "^1.1.12",
+		"@radix-ui/react-dialog": "^1.1.16",
+		"@radix-ui/react-dropdown-menu": "^2.1.17",
+		"@radix-ui/react-select": "^2.3.0",
+		"@radix-ui/react-separator": "^1.1.9",
+		"@radix-ui/react-slot": "^1.2.5",
+		"@radix-ui/react-switch": "^1.3.0",
+		"@radix-ui/react-tabs": "^1.1.14",
+		"@radix-ui/react-tooltip": "^1.2.9",
 		"@shopify/lang-jsonc": "^1.0.1",
 		"alpinejs": "^3.14.1",
 		"arktype": "^2.1.20",
 		"astro": "^4.16.18",
 		"chart.js": "^4.4.7",
+		"class-variance-authority": "^0.7.1",
 		"clsx": "^2.1.1",
 		"date-fns": "^4.1.0",
 		"dotenv": "17.2.1",
 		"drizzle-orm": "0.44.4",
 		"guacamole-lite": "^1.2.0",
+		"ioredis": "^5.11.1",
 		"ip-address": "^9.0.5",
 		"is-cidr": "^5.0.3",
 		"jose": "6.1.0",