refactor: split React surface behind ./react subpath (core barrel react-free)

[orveth]

Standalone PR — targets master directly. One commit, replayed cleanly onto master. The react-removal does not depend on the storage (#4) or crypto-uuid (#5) PRs — it only coincidentally edits src/lib/index.ts in a different region (the storage block #4 adds sits near the top; this PR removes the React export block ~80 lines lower), so it replays onto master without conflict. #4/#5 proceed independently. Re-verified on the master base — not assumed. DO NOT publish — gudnuf-gated.

What changed

Packaging change only — no runtime/logic edits. Importing the default package entry now pulls ZERO react into the module graph; the React provider/contexts/hooks move behind an opt-in <pkg>/react subpath.

• New src/lib/react.ts barrel — re-exports the full core (so /react stays a drop-in superset) plus the React surface: OpenSecretProvider/OpenSecretContext, OpenSecretDeveloper/OpenSecretDeveloperContext, useOpenSecret, useOpenSecretDeveloper, and the React-surface types.
• src/lib/index.ts — dropped the React re-exports; the default barrel is now core-only. It no longer (transitively) imports ./main, ./developer, ./context, ./developerContext, or ./util. All core exports retained.
• Deleted orphan src/lib/util.ts — it imported react (useEffect/useRef) and nothing imported it.
• package.json — added the ./react export; repointed the default artifact to opensecret-core.{es,cjs}.js; made react/react-dom optional peers (peerDependenciesMeta); 0.1.0 → 0.2.0.
• vite.config.ts — two lib entries (index → opensecret-core, react → opensecret-react). Multi-entry lib mode cannot emit UMD → dropped UMD, emit ["es","cjs"] (consumers are ESM/bundler; nothing used the UMD global). React stays externalized exactly as before. vite-plugin-dts now emits both index.d.ts and react.d.ts.
• In-repo demo app (src/AI.tsx, src/App.tsx, src/main.tsx) repointed at ./lib/react (they consume the React surface). No library code; keeps bun run dev and the dts pass clean.

Version / breaking-change note

0.2.0 is breaking only for React consumers (they migrate <pkg> → <pkg>/react). There are none in agicash — agicash imports only the core functions, which stay on the default entry. agicash needs no code change for react-removal.

Gate proof (re-run on the master base; repo has no test script)

bun install + bun run build → green (tsc + vite, exit 0). dist/ contains opensecret-core.{es,cjs}.js, opensecret-react.{es,cjs}.js, index.d.ts, react.d.ts.

THE INVARIANT — react in the FULL core graph (entry + its shared chunk, chunk filenames chased):

$ grep -cE 'from[ "]*react|require\(["]react' \
    dist/opensecret-core.es.js dist/index-L0b06DVu.js \
    dist/opensecret-core.cjs.js dist/index-DwqL0JUQ.cjs
  opensecret-core.es.js  : 0
  index-L0b06DVu.js      : 0     # core ES shared chunk
  opensecret-core.cjs.js : 0
  index-DwqL0JUQ.cjs     : 0     # core CJS shared chunk
  core ES  graph total   : 0
  core CJS graph total   : 0

# react bundle DOES import react:
  opensecret-react.es.js  : 2    # from "react/jsx-runtime"; from "react"
  opensecret-react.cjs.js : 1    # require("react/jsx-runtime"), require("react")

The core entries reference only the shared chunk (index-L0b06DVu.js / index-DwqL0JUQ.cjs), and that chunk is itself react-free, so the core graph is closed and react-free in both formats.

Runtime smoke: bun -e 'await import("./dist/opensecret-core.es.js")' → loads clean (55 exports; configure/signMessage are functions; OpenSecretProvider is undefined on the core bundle, confirming the React surface lives only behind /react).

Core export-set intact — dist/index.d.ts still declares every symbol agicash imports (configure, fetchUser, signIn, signInGuest, signOut, signUp, signUpGuest, convertGuestToUserAccount, confirmPasswordReset, requestPasswordReset, requestNewVerificationCode, verifyEmail, initiateGoogleAuth, handleGoogleCallback, generateThirdPartyToken, getPrivateKey, getPrivateKeyBytes, getPublicKey, signMessage) + types LoginResponse, UserResponse. The React symbols are absent from index.d.ts and present in react.d.ts.

Note: on the master base the core barrel does not carry the storage exports (browserStorage/getStorage) — those are added separately by #4. Their absence here is expected and correct (verified: 0 storage-symbol matches in index.d.ts).

Out of scope (do NOT)

No npm publish, no agicash catalog-pin bump (gudnuf-gated, held for explicit trigger). No agicash / wallet-SDK / consumer edits. No upstream OpenSecretCloud/OpenSecret-SDK changes. No React provider/hook logic touched — only their export location moved.

🤖 Generated with Claude Code

[orveth]

Superseded by #7. The team decided to remove the React surface entirely (delete, no /react subpath) and leave the module settings unchanged, rather than split it. The verified delete lives in #7 — closing this in favor of it.