feat(client): the whole client half (phase 3, slice 3)

The 35 files behind twelve public pages, seven admin views, two player views
and three core-page extensions, ported onto `window.__rg`. Every one of them
imports exactly the seven kit members plus `lib/format.js`, which is the
finding §2.7.1 predicted and this confirms.

`client/src/core.js` is the port mechanism, and unlike the server's it is a
plain read: `window.__rg` is published before any module chunk evaluates, so
there is no gap to defer around and a ported component keeps its ordinary
import shape. `client/src/api.js` rebuilds the UO namespaces over the request
primitive — same URLs, because §1.2 freezes the API surface.

SPA paths changed and API paths did not. `/site/shard` is `/uo/shard`, and the
admin paths lost their now-redundant `shard-` prefixes (`/admin/uo/ops`), a
clean break being the only moment that is free.

`shim/rg.js` becomes the single reader of the global, so the "core did not
publish its dependencies" message is reachable from whichever module the
bundler happens to touch first rather than from whichever one is imported
first — a guarantee that used to last until someone sorted the imports.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/shim/jsx-runtime.js

@@ -7,7 +7,9 @@
 // itself, only harder to see, because it shows up as a hook dispatcher error in
 // a component that looks fine.
 
-const jsxRuntime = window.__rg.jsxRuntime
+import { rg } from './rg.js'
+
+const jsxRuntime = rg().jsxRuntime
 
 export const { jsx, jsxs, jsxDEV, Fragment } = jsxRuntime
 

client/src/shim/react-dom.js

@@ -5,7 +5,9 @@
 // react-dom, and one that resolved to a bundled copy would put a second
 // renderer in the page.
 
-const reactDom = window.__rg.reactDom
+import { rg } from './rg.js'
+
+const reactDom = rg().reactDom
 
 export default reactDom.default ?? reactDom
 

client/src/shim/react-router-dom.js

@@ -5,7 +5,9 @@
 // whose `useParams` returns nothing and whose `<Link>` navigates the browser
 // instead of the SPA, on a page that otherwise renders perfectly.
 
-const router = window.__rg.router
+import { rg } from './rg.js'
+
+const router = rg().router
 
 export default router.default ?? router
 

client/src/shim/react.js

@@ -13,7 +13,9 @@
 // compiles to a named import, and a module with only a default export would fail
 // at link time in the browser with a message about the binding, not about this.
 
-const react = window.__rg.react
+import { rg } from './rg.js'
+
+const react = rg().react
 
 export default react.default ?? react
 

client/src/shim/rg.js

@@ -0,0 +1,29 @@
+// The one place this module reads `window.__rg`, and the one place that says
+// something useful when it is not there.
+//
+// Every shim beside this file, and `src/core.js`, go through here. That is not
+// tidiness — it removes an ordering dependency that was genuinely fragile. ES
+// modules evaluate dependencies in the source order of their import statements,
+// so "put the friendly check in the file that is imported first" is a guarantee
+// that survives exactly until someone sorts the imports. Whichever module the
+// bundler happens to reach first, it reaches `window.__rg` through this.
+//
+// A missing global means core did not publish its shared dependencies before
+// this chunk evaluated: an injection or ordering fault in CORE (MODULE_API.md
+// §3.1), not a fault in this module. Without this, the first symptom is
+// "Cannot read properties of undefined (reading 'react')" thrown from a file
+// called react.js, which reads like the module bundled React wrong — the
+// opposite of what happened.
+export function rg() {
+  const shared = window.__rg
+  if (!shared) {
+    throw new Error(
+      '[module-uo] window.__rg is missing — core did not publish its shared dependencies before this ' +
+      'chunk evaluated. That is an injection or ordering fault in core (MODULE_API.md §3.1), not a ' +
+      'fault in this module.',
+    )
+  }
+  return shared
+}
+
+export default rg