refactor: share trace, error boundary, and proxy http helpers

Lift the trace-to-shape geometry into @tts/mesh (traceToShape/
traceToUvBounds), parameterized by scale so the web token viewer and
@tts/tabletop share one implementation. Move the CORS proxy HTTP helpers
(assetUrl, resolveAssetUrl, traceImage) into a new @tts/http package, and
make @tts/tabletop's ErrorBoundary the single source used by the web app.

This removes the duplicated ErrorBoundary, assetUrl, tabletopHttp, and
trace-to-shape code from apps/web and packages/tabletop.

pnpm-lock.yaml

@@ -87,6 +87,9 @@ importers:
       '@tts/extract':
         specifier: workspace:*
         version: link:../../packages/extract
+      '@tts/http':
+        specifier: workspace:*
+        version: link:../../packages/http
       '@tts/mesh':
         specifier: workspace:*
         version: link:../../packages/mesh
@@ -190,6 +193,22 @@ importers:
         specifier: ^5.7.2
         version: 5.9.3
 
+  packages/http:
+    dependencies:
+      '@tts/shared':
+        specifier: workspace:*
+        version: link:../shared
+      bson:
+        specifier: ^7.3.1
+        version: 7.3.1
+    devDependencies:
+      typescript:
+        specifier: ^5.7.2
+        version: 5.9.3
+      vitest:
+        specifier: ^4.1.10
+        version: 4.1.10(@types/node@22.20.1)(vite@8.2.1(@types/node@22.20.1)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.11)(yaml@2.9.0))
+
   packages/mesh:
     dependencies:
       earcut:
@@ -233,12 +252,12 @@ importers:
       '@tts/bgm':
         specifier: workspace:*
         version: link:../bgm
+      '@tts/http':
+        specifier: workspace:*
+        version: link:../http
       '@tts/mesh':
         specifier: workspace:*
         version: link:../mesh
-      bson:
-        specifier: ^7.3.1
-        version: 7.3.1
       react:
         specifier: ^19.2.8
         version: 19.2.8