Reduce duplicate dependency storage across worktrees

[nighca]

Closes #3234

Summary

• migrate frontend package installs from npm lockfiles to pnpm lockfiles
• update CI, Docker, Vercel, docs, and local tasks to use pnpm
• install SPX web assets as the @xgo-pkgs/spx npm package and expose them through a versioned public/spx_<version> symlink during postinstall
• read the SPX web asset version from @xgo-pkgs/spx/package.json instead of maintaining VITE_SPX_VERSION
• remove the unused ui/prototype package and add explicit pnpm dependencies/types needed under strict dependency resolution
• update the SPX upgrader agent instructions for the npm-package-based SPX workflow

How This Reduces Duplicate Storage

• pnpm stores package contents in its global content-addressable store, so multiple local git worktrees can share the same downloaded package files instead of each worktree keeping a full npm-style copy under node_modules/.
• SPX web runtime assets are now distributed as @xgo-pkgs/spx, so the large SPX runner files also participate in pnpm's shared store instead of being downloaded and unpacked separately per worktree.
• Each worktree only keeps lightweight links from node_modules/ and public/spx_<version> to the shared package content, while the versioned public path keeps the existing cache-invalidation behavior for deployed runner assets.

Validation

• corepack pnpm@11.9.0 install --frozen-lockfile in spx-gui
• corepack pnpm@11.9.0 install --frozen-lockfile in tutorial
• bash link-spx.sh in spx-gui
• corepack pnpm@11.9.0 run type-check in spx-gui
• corepack pnpm@11.9.0 run lint in spx-gui
• corepack pnpm@11.9.0 run format-check in spx-gui
• corepack pnpm@11.9.0 run test -- --run in spx-gui
• bash build-wasm.sh in spx-gui
• corepack pnpm@11.9.0 run build in spx-gui
• corepack pnpm@11.9.0 run build:account in spx-gui
• bash vercel-build.sh in spx-gui after deleting public/spx_2.0.4 and dist, verifying dist/spx_2.0.4/runner.html contains the SPX runner
• dev server smoke test with @xgo-pkgs/spx@2.0.5-0.20260708083310-ffe456ac46fd, then reverted the temporary version bump
• git diff --check

[nighca]

给 function 添加显式的对返回类型的标注，因为 pnpm 默认的依赖（在 node_modules/ 中的）组织方式影响了 TS 的行为，这里虽然能推断出类型，但是会有 TS2742 的问题：

The inferred type of 'xxx' cannot be named without a reference to ...
This is likely not portable. A type annotation is necessary.

详见 pnpm/pnpm#7453

spx-gui/src/utils/utils.ts 中的改动是相同的原因

[nighca]

后面这个 TODO 如果解决了，link-spx.sh 就也可以干掉了

[nighca]

最新的与 UI 约定的工作流是基于真实代码实现 prototype 而不是维护单独的 ui 分支或目录，所以 ui/prototype/ 目录现在没用了，留着的话还要做 pnpm 的迁移，所以顺便干掉了