Next.js app scaffold + golden path UI

# Why?

**As a** user of rms-app

**I want** a working web interface to browse, borrow, and return items

**So that** I'm not limited to the SMS router or direct API calls.

# What?

New `web/` directory (own `package.json`, separate from the repo root's Expo/React Native config), a Next.js app using `@aws-amplify/adapter-nextjs` for SSR-aware Cognito session handling, calling the API Gateway endpoints from #304 with Google SSO login from #305.

Golden path: login (Google SSO via Cognito Hosted UI) → browse/search items → borrow → return → view reservations.

**Additional requirements surfaced after #305 shipped** (raised directly by the repo owner, to be scoped concretely in this issue's own plan-mode session, not guessed at here):
- **Link borrowers/owners to Google accounts**: the existing `MainSchema.owner` / borrower fields are currently free-text strings (see `ts-code/src/db/Schemas.ts`) — decide whether/how these should associate with a signed-in user's Cognito identity (e.g. `sub` or email) rather than staying arbitrary text, and what that means for existing seed data / the SMS router's borrower field (which has no Google identity at all).
- **"Remember me" / cached session**: Cognito Hosted UI sessions are already persisted via refresh tokens by default, but the ask is specifically an opt-in "not a public computer" checkbox on the login page that extends session length/persistence (vs. a shorter-lived session by default) — needs concrete session-duration/storage design (e.g. Amplify's token refresh + `tokenRefresher`/cookie settings under `@aws-amplify/adapter-nextjs`), not just relying on Cognito's default behavior.
- **Self-service profile editing**: users need a way to update their own email and name (real-world case: legal name/email changes after marriage) — likely a profile page calling Cognito's `UpdateUserAttributes` (or admin-side equivalent if email changes need re-verification), scoped alongside the golden path.

# Additional context

Part of #303 (new Next.js web frontend). **Depends on #304 (API Gateway) and #305 (Google SSO)** — both complete. This issue is intentionally left light on implementation detail; its own plan-mode session should scope the actual page/component breakdown (including the three items above) against the real, deployed shape of #304/#305 rather than guessing now.

Per root `CLAUDE.md`'s testing policy: Jest + React Testing Library (`web/**/*.test.tsx`) for components/utilities, Playwright e2e (`web/e2e/`) for the golden path.

Replaces the abandoned `frontend/` (React Native/Expo, last touched 2021, not built/deployed by CI) — not a migration from it, just a full replacement.