refactor(data): route full NextGraph surface through @ng-eventually/client

The app now takes its NextGraph runtime AND types from @ng-eventually/client; the
only place that imports the real @ng-org SDK is ngSession (the single injection point for
configure()). Lifecycle (init/initNg), data (useShape) and types (ShapeType, DeepSignalSet,
NG…) all go through the lib. Test infra (auth-setup, mock harness) and generated ORM
bindings keep a direct @ng-org import (documented). Validated: build, @ui 4/4, @data 8/8
against the real broker.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/shared/hooks/useShapeWithDefaults.ts

@@ -9,8 +9,7 @@
  */
 
 import { useShape } from '@ng-eventually/client';
-import type { ShapeType, BaseType } from '@ng-org/shex-orm';
-import type { DeepSignalSet } from '@ng-org/alien-deepsignals';
+import type { ShapeType, BaseType, DeepSignalSet } from '@ng-eventually/client';
 export interface ShapeWithDefaults<NgT extends BaseType, AppT> {
   /** Mapped items from NG store */
   items: AppT[];

src/shared/test-harness/harness-ng.tsx

@@ -12,7 +12,7 @@ import { createRoot } from 'react-dom/client';
 import { NextGraphProvider, useNextGraph } from '../context/NextGraphContext';
 import { FestipodDataProvider, useFestipodData } from '../context/FestipodDataContext';
 import { useShape } from '@ng-eventually/client';
-import type { DeepSignalSet } from '@ng-org/alien-deepsignals';
+import type { DeepSignalSet } from '@ng-eventually/client';
 import {
   FpEventShapeType,
   FpUserProfileShapeType,

src/shared/utils/ngBootstrap.ts

@@ -5,7 +5,7 @@
  * has events/users, it's a returning user — skip seeding.
  */
 
-import type { DeepSignalSet } from '@ng-org/alien-deepsignals';
+import type { DeepSignalSet } from '@ng-eventually/client';
 import type { FpEvent, FpUserProfile, FpParticipation } from '../shapes/orm/festipodShapes.typings';
 import { ensureGraphNuri } from './ngGraph';
 import {

src/shared/utils/ngSession.ts

@@ -1,14 +1,16 @@
-import { ng, init as initNgWeb } from "@ng-org/web";
-import type { NG } from "@ng-org/web";
-import { initNg as initNgSignals } from "@ng-org/orm";
+// Injection point — the ONLY app module that imports the real @ng-org SDK, to
+// inject it into the ng-eventually polyfill. Every other Festipod module gets
+// its NextGraph surface from @ng-eventually/client. Removed at migration.
+import { ng as realNg, init as realInit } from "@ng-org/web";
+import type { NG } from "@ng-eventually/client";
+import { initNg as realInitNg } from "@ng-org/orm";
 import { useShape as realUseShape } from "@ng-org/orm/react";
-import { configure as configureEventually } from "@ng-eventually/client/polyfill";
+import { configure } from "@ng-eventually/client/polyfill";
 
-// Inject the REAL SDK into the ng-eventually polyfill. The app imports the
-// SDK-shaped exports (`useShape`, `ng`, `inbox`) from `@ng-eventually/client`,
-// which delegate to what we inject here. This is the single injection point —
-// removed at migration (the app then points back at the real SDK).
-configureEventually({ ng, useShape: realUseShape });
+// SDK-shaped surface used by ngSession itself — taken from the lib, not @ng-org.
+import { ng, init as initNgWeb, initNg as initNgSignals } from "@ng-eventually/client";
+
+configure({ ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg });
 
 export let session: NextGraphSession | undefined;
 
@@ -33,17 +35,17 @@ let initPromise: Promise<void> | null = null;
 export function init(): Promise<void> {
     if (initPromise) return initPromise;
     console.log('[NG session] init() called — registering callback');
-    initPromise = initNgWeb(
+    initPromise = (initNgWeb(
         async (event: any) => {
             session = event.session;
-            session!.ng ??= ng;
+            session!.ng ??= realNg;
             console.log('[NG session] Connected — private_store:', session!.private_store_id);
             resolveSessionPromise(session!);
-            initNgSignals(ng, session!);
+            initNgSignals(realNg, session!);
         },
         true,
         []
-    ).catch((error) => {
+    ) as Promise<void>).catch((error: any) => {
         console.error('[NG session] init error:', error);
         rejectSessionPromise(error);
     });