fix(tanstackstart-react): Unminify server errors in Nitro builds - #25360

## Summary

`apps/web` now builds with Nitro v3's `nitro/vite` plugin instead of `@tanstack/nitro-v2-vite-plugin`. TanStack removed the old plugin upstream in TanStack/router#8537, and its last release was 1.155.2. TanStack's hosting guide and examples use `nitro/vite`, and so do Sentry's e2e apps.

**This PR is a draft until the Vercel preview checks below pass.**

## Changes

- **`apps/web/vite.config.ts`**
  - `nitroV2Plugin(...)` is replaced by `nitro({ compatibilityDate: '2026-09-04', sourcemap: false })`.
  - The plugin order is unchanged, and the Sentry plugins stay last.
  - No preset is set, because Nitro detects Vercel by itself.
  - Comments are rewritten for Nitro v3.
- **Catalog**
  - `nitro` is pinned exactly to `3.0.260903-beta`. That is the current `latest`, and it is a beta: Nitro v3 is not GA yet.
  - The nitropack 2.13.4 tree leaves the lockfile: 162 packages that only it reached, plus one peer resolution that now uses the version already in the tree.
- **Server source maps stay off on purpose (`sourcemap: false`).** Nitro 3 already defaults to `false`. But getsentry/sentry-javascript#25360, an open PR, would switch Nitro's server maps to `hidden` by itself whenever the Nitro config sets nothing. A routine, auto-merged Sentry minor would then start emitting and uploading server maps without anyone deciding to. The pin keeps the 2026-10-03 decision explicit, and #25360 is the moment to revisit it.
- **Sentry `filesToDeleteAfterUpload`.** The client maps now land in `.output/public` locally and in `.vercel/output/static` on Vercel. The existing globs cover both. `./dist/**/*.map` stays, with a comment: it only matters if Nitro never ran and Vercel served `dist/`.
- **`.github/renovate.json`.** A new rule makes `nitro` updates wait for approval on the Dependency Dashboard and takes them out of the non-major group. A new date-stamped beta counts as a patch and would otherwise auto-merge on green. The required e2e check would not catch leaked maps, changes in Sentry's uploads, or a drift in runtime or region.
- **Docs.** CLAUDE.md's Sentry source-map entry and Renovate entry are updated. `docs/research/2026-10-03-server-source-maps.md` is marked superseded: its four nitropack-2 internals no longer apply.

## Behaviour changes (verified locally)

- **Function name on Vercel:** `__fallback.func` becomes `__server.func`.
- **Runtime:** `nodejs22.x` becomes `nodejs24.x`. Nitro maps the build machine's Node major, and the project is set to `24.x`.
- **Function size:** 23 MB becomes 8.8 MB.
- **Server source maps:** before, the function shipped 43 server `.map` files that were never deleted. Now it ships none.
- **Caching:** `/assets/*` gets `cache-control: public, max-age=31536000, immutable`.
- **Sentry plugin:** it runs in three Vite environments (client, ssr, nitro).
  - Release create and finalize are idempotent, and the deploy record is created only once per process.
  - `ssr` and `nitro` log "No source maps found…" and upload nothing.

## Motivation

This is a follow-up from #133. The v2 plugin still works but is unmaintained, and nothing after it is a v2 path. TanStack and Sentry have both moved to Nitro v3.

## Testing

**Local**
- `pnpm check`, `pnpm typecheck`, `pnpm check:vite-plus` and `pnpm install --frozen-lockfile` pass.
- 883 unit tests and 130 Storybook tests pass, and `build-storybook` succeeds.
- `routeTree.gen.ts` is unchanged and still has its `Register` block.
- The build succeeds with 0 maps in `.output`. `node .output/server/index.mjs` serves `/login` with 200, so `start` and Playwright's `webServer` still work.
- `VERCEL=1` builds produce `__server.func` with `nodejs24.x` and 0 maps.
- `vp dev` serves `/login` with 200.

**Gate before marking ready, on this PR's preview**
1. The build log shows `Using nodejs24.x runtime`, exactly one "Successfully uploaded source maps to Sentry", and no Sentry errors.
2. Sentry has one release for the commit and exactly one `preview` deploy record.
3. `__server.func/.vc-config.json` has `"runtime": "nodejs24.x"`, and there is no `.map` under `static/` or in the function. `GET /assets/<chunk>.js.map` serves no map.
4. The deployment reports `regions: ["fra1"]`.
5. `/assets/*` carries the immutable cache header, and HTML routes do not.
6. "e2e against the preview" is green.

## Breaking Changes

None for users of the app. For contributors: the server build output and the Vercel function layout changed as described above.

**Known and not blocking:**
- The build log carries about 478 harmless `MODULE_LEVEL_DIRECTIVE "use client"` warnings.
- nitrojs/nitro#4693: in dev only, a request after a main-thread stall of more than about 5 seconds, such as a debugger pause, can fail with ECONNRESET.