feat(web): add authenticated Habit BFF

[seonghobae]

Advances #209 as a dependency-ordered child of the canonical Task BFF successor #238 (feat/web-task-bff-v2@2d14b19d349348bc84e12165bdfc079a6848c7cd). The previous base #224 was fully transferred to #238 without changing the Task-BFF tree; this PR was retargeted non-destructively and its exact head remains 3246929a9fef8362e28352ffa825f33be7e2b129. No predecessor check/review evidence transfers across the base-state change.

This bounded slice adds first-party authenticated Habit create/list browser boundaries. The web boundary derives workspace authority from Identity, signs the existing Habit life-os.workspace.v1 context with the Habit-owned gateway secret, forwards no browser credential to Habit service, validates returned tenant/schema/recurrence evidence, rejects authority-bearing browser input, and exposes only browser-safe Habit records.

Test-first RED starts at 4326062de6643ce0578a9068329c16431851b85a, which deliberately wires habit-client.test.ts into the web test command before the production module exists.

Keep Draft until #238 and its prerequisites integrate/restack through normal policy and the unchanged exact head satisfies focused/full repository CI, central security/review workflows, review-thread resolution and live-base compatibility. This slice adds no Habit workspace UI and does not close #209.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}