Next.js app scaffold + golden path UI

# Why?

**As a** user of rms-app

**I want** a working web interface to browse, borrow, and return items

**So that** I'm not limited to the SMS router or direct API calls.

# What?

New `web/` directory (own `package.json`, separate from the repo root's Expo/React Native config), a Next.js app using `@aws-amplify/adapter-nextjs` for SSR-aware Cognito session handling, calling the API Gateway endpoints from #304 with Google SSO login from #305.

Golden path: login (Google SSO via Cognito Hosted UI) → browse/search items → borrow → return → view reservations.

**Additional requirements surfaced after #305 shipped** (raised directly by the repo owner, to be scoped concretely in this issue's own plan-mode session, not guessed at here):
- **Link borrowers/owners to Google accounts**: the existing `MainSchema.owner` / borrower fields are currently free-text strings (see `ts-code/src/db/Schemas.ts`) — decide whether/how these should associate with a signed-in user's Cognito identity (e.g. `sub` or email) rather than staying arbitrary text, and what that means for existing seed data / the SMS router's borrower field (which has no Google identity at all).
- **"Remember me" / cached session**: Cognito Hosted UI sessions are already persisted via refresh tokens by default, but the ask is specifically an opt-in "not a public computer" checkbox on the login page that extends session length/persistence (vs. a shorter-lived session by default) — needs concrete session-duration/storage design (e.g. Amplify's token refresh + `tokenRefresher`/cookie settings under `@aws-amplify/adapter-nextjs`), not just relying on Cognito's default behavior.
- **Self-service profile editing**: users need a way to update their own email and name (real-world case: legal name/email changes after marriage) — likely a profile page calling Cognito's `UpdateUserAttributes` (or admin-side equivalent if email changes need re-verification), scoped alongside the golden path.

# Additional context

Part of #303 (new Next.js web frontend). **Depends on #304 (API Gateway) and #305 (Google SSO)** — both complete. This issue is intentionally left light on implementation detail; its own plan-mode session should scope the actual page/component breakdown (including the three items above) against the real, deployed shape of #304/#305 rather than guessing now.

Per root `CLAUDE.md`'s testing policy: Jest + React Testing Library (`web/**/*.test.tsx`) for components/utilities, Playwright e2e (`web/e2e/`) for the golden path.

Replaces the abandoned `frontend/` (React Native/Expo, last touched 2021, not built/deployed by CI) — not a migration from it, just a full replacement.

這項工作包括在 `web/` 目錄中建立新的 Next.js 應用程式、整合 AWS Amplify 和 Cognito 以進行驗證，以及連接到現有的 API。首先檢查已完成的 #304 (API Gateway) 和 #305 (Google SSO) issue，以了解已部署的相依套件。檢視 `ts-code/src/db/Schemas.ts`，了解目前的資料模型。Golden Path 包括登入、瀏覽、借用和歸還項目，因此需要設計多個頁面和元件。當具備指定功能的完整可用 Web 介面完成，且 Jest/Playwright 測試通過時，即表示完成。

由索引模型根據 Issue 內容生成。