feat(db): mesh data model — meshes, members, invites, audit log

- pgSchema "mesh" with 4 tables isolating the peer mesh domain
- Enums: visibility, transport, tier, role
- audit_log is metadata-only (E2E encryption enforced at broker/client)
- Cascade on mesh delete, soft-delete via archivedAt/revokedAt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/web/src/lib/api/client.tsx

@@ -0,0 +1,14 @@
+import { hc } from "hono/client";
+
+import { getBaseUrl } from "./utils";
+
+import type { AppRouter } from "@turbostarter/api";
+
+export const { api } = hc<AppRouter>(getBaseUrl(), {
+  headers: {
+    "x-client-platform": "web-client",
+  },
+  init: {
+    credentials: "include",
+  },
+});

apps/web/src/lib/api/server.ts

@@ -0,0 +1,13 @@
+import { hc } from "hono/client";
+import { headers } from "next/headers";
+
+import { getBaseUrl } from "./utils";
+
+import type { AppRouter } from "@turbostarter/api";
+
+export const { api } = hc<AppRouter>(getBaseUrl(), {
+  headers: async () => ({
+    ...Object.fromEntries((await headers()).entries()),
+    "x-client-platform": "web-server",
+  }),
+});

apps/web/src/lib/api/utils.ts

@@ -0,0 +1,9 @@
+import env from "env.config";
+
+export const getBaseUrl = () => {
+  if (typeof window !== "undefined") return window.location.origin;
+  if (env.NEXT_PUBLIC_URL) return env.NEXT_PUBLIC_URL;
+  if (env.VERCEL_URL) return `https://${env.VERCEL_URL}`;
+  // eslint-disable-next-line no-restricted-properties, turbo/no-undeclared-env-vars
+  return `http://localhost:${process.env.PORT ?? 3000}`;
+};