chore: move the starters onto the current seamless auth packages

[Bccorb]

Bumps every Seamless Auth package the starters depend on, and follows through on the one change that reaches template code.

Versions

Template	Package	From	To
react-vite	@seamless-auth/react	0.9.0	0.11.0
react-oauth	@seamless-auth/react	0.9.0	0.11.0
express	@seamless-auth/express	0.12.0	0.13.0
fastify	@seamless-auth/fastify	0.3.1	0.4.0

All three are 0.x minors, so a caret range on the old version never resolved to them. A project scaffolded from these templates stayed on whatever was pinned here.

What the bumps needed

The published type surfaces and bundles were diffed old against new, rather than reading version numbers and guessing.

Express and Fastify: no code change. Type surfaces, READMEs, and file lists are identical between versions. The only behaviour change is a pass-through: both adapters now forward a redirectUri from the magic link request body to the auth API. The starters mount the adapter and nothing else, so the version bump is the whole change.

React: one change. 0.11.0 stopped reading --seamless-disabled, when the disabled submit button became the enabled button at reduced opacity instead of a filled grey. The token was set in shared/react-app/index.css, so it is removed there and npm run sync:shared carried it into both starters' copies. Every other --seamless-* token is untouched.

Two bundled-screen behaviour changes arrive that no starter code drives: passkey enrolment no longer asks for a device name before the browser prompt, and the sign-in screen now explains a disabled submit in a live region.

Not included

0.10 and 0.11 add capability the starters do not use: AuthProvider's magicLinkRedirectUri, returnTo on finishOAuthLogin, an attachment for registerPasskey, and getPasskeyPolicyErrorCode(). Adopting any of them is a feature change rather than follow-through on a version, so they are left for their own pull request.

Worth noting for that one: the OAuth starter's own callback page hardcodes navigate("/"). That stays correct here, because its login sends no returnTo and the field comes back absent, but the bundled view now honours a destination and the starter does not demonstrate it.

Verification

npm run validate and the root format:check pass. In each of the four templates, npm install (confirming 0.11.0, 0.13.0 and 0.4.0 resolved), then npm run check and npm run build:

• react-vite: 80 tests across 11 files, build clean
• react-oauth: 84 tests across 12 files, build clean
• express: 14 tests, build clean
• fastify: 14 tests, build clean

Lockfiles also pick up transitive jose and zod bumps, as a normal consequence of reinstalling against the new resolutions.