feat(api,web): c2 consulta de clientes — list + search + auth flow

prisma: modelo Client + migração 20260527225728_add_client + seed dev (10 clientes)
api: GET /clients (list, busca, filtro atividade/financeiro, paginação) + GET /clients/:id
     rep vê carteira própria; supervisor/admin vê tudo; activityStatus calculado de lastOrderAt
@sar/api-interface: ClientSummarySchema, ClientDetailSchema, ClientListResponseSchema
web: ClientsPage (tabela AntD, busca, filtro), DevLogin (token dev), authStore, Bearer no apiFetch
oq-4 resolvida: creditLimit gerenciado no SAR

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/src/lib/queries/clients.ts

@@ -0,0 +1,45 @@
+import { useQuery } from '@tanstack/react-query';
+import {
+  ClientListResponseSchema,
+  ClientDetailSchema,
+  type ClientListQuery,
+  type ClientListResponse,
+  type ClientDetail,
+} from '@sar/api-interface';
+import { apiFetch } from '../api-client';
+
+export const CLIENT_KEYS = {
+  all: ['clients'] as const,
+  list: (params: Partial<ClientListQuery>) => ['clients', 'list', params] as const,
+  detail: (id: string) => ['clients', 'detail', id] as const,
+};
+
+export function useClientList(params: Partial<ClientListQuery> = {}) {
+  const qs = new URLSearchParams();
+  if (params.q) qs.set('q', params.q);
+  if (params.status) qs.set('status', params.status);
+  if (params.financialStatus) qs.set('financialStatus', params.financialStatus);
+  if (params.page) qs.set('page', String(params.page));
+  if (params.limit) qs.set('limit', String(params.limit));
+
+  const query = qs.toString();
+
+  return useQuery<ClientListResponse, Error>({
+    queryKey: CLIENT_KEYS.list(params),
+    queryFn: async () => {
+      const raw = await apiFetch(`/api/v1/clients${query ? `?${query}` : ''}`);
+      return ClientListResponseSchema.parse(raw);
+    },
+  });
+}
+
+export function useClientDetail(id: string) {
+  return useQuery<ClientDetail, Error>({
+    queryKey: CLIENT_KEYS.detail(id),
+    queryFn: async () => {
+      const raw = await apiFetch(`/api/v1/clients/${id}`);
+      return ClientDetailSchema.parse(raw);
+    },
+    enabled: !!id,
+  });
+}