create-miden-turnkey-react passes the project name through a shell command

### Problem

The `create-miden-turnkey-react` CLI interpolates the user-provided project name directly into a shell command:

```js
execSync(`npm create vite@latest ${projectName} -- --template react-ts`, ...)
```

File evidence: `packages/create-miden-turnkey-react/bin/create-miden-turnkey-react.mjs`.

This means project names containing spaces or shell metacharacters are parsed by the shell instead of being passed to `npm create vite` as one argument. The same file already imports `spawn`, so the intended command execution style is close by, but the create step still uses a shell string.

### Why this matters

A scaffolding CLI should pass user input as argv values. Otherwise valid-looking project names can fail to scaffold correctly, and the behavior depends on the user's shell parsing rules.

### Suggested fix

Run the Vite create command with an argument array, for example via `spawnSync` or equivalent, so `projectName` is passed as a single argument. The install step can use the detected package manager as the executable with `install` as an argv argument as well.