feat: prepare CLI apps for registered iframe queries

[robinvrd]

Summary

Generated apps keep SQL in queries.json and named variable metadata in variables.json. Browser code runs in an iframe and executes query IDs with values through the same bridge as hosted apps. The trusted Bun host resolves registration and uses the CLI HTTP proxy.

• Include both registration files in the scaffold and document the three-artifact contract.
• Validate query IDs, registration, and browser import boundaries during project checks; execute registered queries during live checks.
• Update the starter server and browser tests for the iframe host while preserving support for existing app projects.

Required before merge

Publish the package changes in altertable-ai/data-app#33, then bump the exact @altertable/data-app pins in data-app/starter/package.json and data-app/tests/package.json and regenerate both lockfiles. Their current published 0.65.0 dependency lacks the new registration and local server APIs, so the normal verification scripts currently stop at starter typechecking. This draft is not ready to release until those pins are updated and verification passes against the published package.

Companion agent instructions: altertable-ai/skills#87.

Validation

• CLI typecheck, lint, and formatting passed.
• 12 focused project-check, distribution, and proxy tests passed.
• Against an immutable archive of the candidate data-app package: starter and consumer test types, lint, formatting, starter build, browser bundle checks, and a live registered query through the HTTP proxy passed.
• All 40 desktop/phone consumer browser tests passed against that candidate archive.
• Both normal verification modes were attempted; they remain blocked by the published dependency pin described above.