feat(p7): ai-studio demo + smoke-ai; P7 verification green

Task 7.6: apps/ai-studio (Vite, port 5177) — ingest a message, run CLASSIFY/
SUMMARIZE/EXTRACT, see proposal cards with confidence, evidence citations,
abstention, model/cost + a budget meter, and accept/reject; built on the ai-web
SDK via AiProvider. scripts/smoke-ai.mjs proves the P7 guarantees end to end:
auto-CLASSIFY → AI flag → routing REVIEW/DENY never ALLOW (KG-05), summary cites
evidence, EXTRACT stays DISCUSSION (Scenario 7), replay-once, accept.

P7 verification: 79 tests green (3x stable), pnpm -r build all packages+demos,
boundary passes and fails on ai-web->service, smoke-ai PASS, prior smokes
(realtime/inbox/support/adapter/route) PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/ai-studio/src/main.tsx

@@ -0,0 +1,32 @@
+import { createRoot } from 'react-dom/client';
+import { AiProvider } from '@insignia/iios-ai-web';
+import { useEffect, useState } from 'react';
+import { App, SERVICE } from './App';
+
+const APP_ID = 'portal-demo';
+
+async function devToken(userId: string): Promise<string> {
+  const r = await fetch(`${SERVICE}/v1/dev/token`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ appId: APP_ID, userId, name: userId }),
+  });
+  if (!r.ok) throw new Error(`devToken ${r.status} (service running with IIOS_DEV_TOKENS=1?)`);
+  return ((await r.json()) as { token: string }).token;
+}
+
+function Root() {
+  const [token, setToken] = useState<string | null>(null);
+  useEffect(() => {
+    void devToken('ai-studio').then(setToken);
+  }, []);
+  if (!token) return <div style={{ padding: 16, fontFamily: 'sans-serif' }}>loading…</div>;
+  return (
+    <AiProvider serviceUrl={SERVICE} token={token}>
+      <App token={token} />
+    </AiProvider>
+  );
+}
+
+const el = document.getElementById('root');
+if (el) createRoot(el).render(<Root />);