feat(web-tanstack): register security middleware and wire nonce to __root

- Add @tanstack/start + vinxi to deps so defineConfig is available
- Uncomment defineConfig registration in app.config.ts — middleware
  is now actually wired into the Nitro server hook, not just defined
- Update __root.tsx loader to call getNonce(getEvent().node.req)
  from @repo/core-shared/security/tanstack so the per-request nonce
  is read server-side and injected via <meta name="csp-nonce">
- Update __root.test.tsx: mock provides useLoaderData and asserts
  the nonce meta tag is rendered with the correct content

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web-tanstack/package.json

@@ -21,8 +21,10 @@
     "@sentry/react": "^10.52.0",
     "@tanstack/react-query": "^5.66.0",
     "@tanstack/react-router": "^1.120.0",
+    "@tanstack/start": "^1.120.0",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "react-dom": "^19.0.0",
+    "vinxi": "0.5.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.50.0",