feat(web-tanstack): Sentry instrumentation via @sentry/node + @sentry/react + R38 PII test

Adds initSentryServerNode + initSentryClientReact to core-shared
(Vite/non-Next variants of the existing init helpers — same R31/R32/R33
posture, R34/R35/R37 replay defaults). Extends no-sentry.ts to mock
@sentry/node + @sentry/react. Wires the web-tanstack server/client
instrumentation entry hooks and adds the R38 PII test.

Spec deviation: web-tanstack has no vite.config.ts yet (placeholder app
per its package.json). The @sentry/vite-plugin dep is added but unused
until the TanStack Start build is wired in a later plan. A minimal
src/vite-env.d.ts shims ImportMetaEnv for the client entry until the
full Vite types land.

@sentry/node and @sentry/react are added to core-shared as optional
peerDependencies so feature packages don't transitively pull them in;
they're also devDependencies of core-shared for typecheck/test runs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/core-shared/src/instrumentation/sentry/init-client-react.ts

@@ -0,0 +1,48 @@
+// packages/core-shared/src/instrumentation/sentry/init-client-react.ts
+import * as SentryReact from "@sentry/react";
+import { beforeSend, beforeSendTransaction } from "./scrub";
+import type { InitClientOpts } from "./init-client";
+
+/**
+ * Client-side init for non-Next.js (Vite/React) runtimes (TanStack Start).
+ * Mirrors init-client.ts but uses @sentry/react directly. R31, R32, R33,
+ * R34, R35, R37 still apply.
+ */
+export function initSentryClientReact(opts: InitClientOpts): void {
+  if (!opts.dsn) return;
+
+  const isProd = process.env["NODE_ENV"] === "production";
+  const tracesSampleRate =
+    process.env["SENTRY_TRACES_SAMPLE_RATE"] !== undefined
+      ? Number(process.env["SENTRY_TRACES_SAMPLE_RATE"])
+      : isProd
+        ? 0.1
+        : 1.0;
+
+  const environment =
+    process.env["SENTRY_ENVIRONMENT"] ?? process.env["NODE_ENV"] ?? "development";
+  const release = opts.release ?? "unknown";
+
+  type InitOpts = Parameters<typeof SentryReact.init>[0];
+  SentryReact.init({
+    dsn: opts.dsn,
+    environment,
+    release,
+    tracesSampleRate,
+    sendDefaultPii: false, // R31
+    beforeSend: beforeSend as unknown as NonNullable<InitOpts>["beforeSend"], // R32
+    beforeSendTransaction:
+      beforeSendTransaction as unknown as NonNullable<InitOpts>["beforeSendTransaction"], // R33
+    replaysSessionSampleRate: 0.0, // R37
+    replaysOnErrorSampleRate: 1.0, // R37
+    integrations: [
+      // R34, R35 — mandatory mask flags; allowlist starts empty
+      SentryReact.replayIntegration({
+        maskAllText: true,
+        maskAllInputs: true,
+        blockAllMedia: true,
+      }),
+    ],
+    initialScope: { tags: { app: opts.app } },
+  });
+}