feat(sdk): <TurboSignForm> embed widget (React + web component) wrapping the completion postMessage

Summary

Ship a <TurboSignForm> React component + a framework-agnostic web component that wraps the embedded signing iframe, so integrators don't hand-roll the postMessage plumbing. This is the piece most competitors ship (DocuSeal <DocusealForm>, Documenso @documenso/embed-react, Dropbox Sign hellosign-embedded, PandaDoc pandadoc-signing) that a bare-iframe integration lacks.

What it does

• Takes an embedUrl (from TurboSign.createEmbeddedSignature(...) → recipients[].embedUrl) and renders the iframe with sensible sizing.
• Listens for the turbosign:completed postMessage and exposes callbacks: onCompleted({ documentId }), and (when we add them) onDeclined / onError.
• Bakes in the origin check (only accept messages from the known TurboSign origin) — the BoldSign pattern — so integrators can't forget it.
• Ships as @turbodocx/embed-react (React) + a <turbosign-form> web component for other frameworks.

Context

Fast-follow to the createEmbeddedSignature convenience method (SDK PR #77). Competitive research: DocuSeal/Documenso/Dropbox Sign/PandaDoc all provide a widget; only BoldSign leaves you on a bare iframe.

Acceptance

• <TurboSignForm embedUrl onCompleted /> renders the iframe and fires onCompleted on turbosign:completed, with the origin pinned.
• A framework-agnostic web component with the same behavior.
• Docs + an example using it (replace the hand-rolled listener in examples/embedded-web-app).

Start by reviewing examples/embedded-web-app and the createEmbeddedSignature context from SDK PR #77 to understand the existing iframe and postMessage flow. Done means a React component and framework-agnostic web component render the embedUrl, handle the completion message with a pinned origin, and include updated docs and an example replacing the hand-rolled listener.