Web redesign Phase 1/8: Design system + restyle existing pages

`s and inline styles.

# What?

Phase 1 of an 8-phase redesign of `web/` modeled after our internal Retool RMS app (`https://a2nseattle.retool.com/p/rms-alpha/main`). This phase is a **pure visual/IA restyle** of what exists today — no new data model, no new flows, no new routes.

Scope:
- Restyle `(protected)/layout.tsx` (nav shell), `browse/page.tsx`, `items/[id]/page.tsx`, `reservations/page.tsx`.
- Introduce a minimal scoped design system: CSS custom properties (colors, spacing, radius) scoped via a class on `(protected)/layout.tsx`'s root wrapper (e.g. `.app-shell { --color-primary: ...; }`) — **not** on `:root`/`body` in `app/globals.css`, since `globals.css` is shared with `/login` and `/test-login`.
- Build small shared UI primitives under `web/components/ui/` (Button, Table, Tabs, Badge/Tag, Card, Checkbox) as plain CSS-module-backed React components — no new dependency (no Tailwind/MUI), keeping `web/`'s dependency footprint the same as today.
- Reuse existing patterns: `web/lib/session.ts`, `web/lib/api/client.ts`'s `callRmsApi` pattern, and the existing Server Action pattern (`borrowAction`/`returnAction`/`reserveAction` in `items/[id]/page.tsx`) — don't introduce a new data-fetching pattern.
- Same routes, same Server Actions — purely presentational.

# Hard constraints

- `/login` and `/test-login` must remain visually and functionally untouched. Do not edit `web/app/login/page.tsx` or `web/app/test-login/page.tsx`, and do not apply global styling changes that reach them.
- After this change, manually load `/login` and `/test-login` to confirm they're visually unaffected by the new scoped theme.
- Playwright specs (`golden-path.spec.ts`, `reservations.spec.ts`) assert on roles/text/labels, not styles or DOM structure — confirmed safe to restyle freely, but selectors like `getByRole("button", { name: "Borrow" })`, `getByText("(available)")`, and `input[name="start"]` must keep working. If copy or form field names change, update these specs in the same PR.

# Testing

Update existing Jest/RTL and Playwright tests only as needed to match any changed copy/markup, per this repo's testing policy (every change needs a corresponding test change).

# Additional context

This is the smallest, lowest-risk phase of a larger redesign and unblocks visual groundwork for the rest of the series:
- Phase 2: backend read APIs (owned/borrowed items, overdue, upcoming reservations)
- Phase 3: dashboard page (User/Resources/Batches tabs, alerts)
- Phase 4: resources list + basket-style multi-select borrow/reserve
- Phase 5: return flow + batches view
- Phase 6: room reservations (no borrow/return)
- Phase 7: batched return-by-reservation with condition notes
- Phase 8: extend reservation

Each will be filed as its own issue and linked back to this series.