feat(portal-shell): replace nx-welcome with real shell and home + budgets per ADR-0017

Cuts the Nx scaffold's `NxWelcome` page (938 LOC of placeholder
markup) and lays down the actual portal layout — header, main,
footer landmarks plus a skip link — with a real home page and
the two RGAA-mandated accessibility statement routes. Bundle
budgets in `project.json` are tightened to match ADR-0017.

Layout shell (apps/portal-shell/src/app/):

- components/header/  — brand link + primary nav landmark stub
- components/footer/  — accessibility statement links (FR + EN)
                        + version badge
- app.html / app.scss — flex column with sticky footer + skip
                        link to #main-content (WCAG 2.4.1)

Pages:

- pages/home/         — welcome heading + "system status" widget
                        that fetches /api/health from the BFF.
                        Doubles as a smoke test of the full
                        SPA → BFF stack: CORS, OTel trace
                        propagation, Pino log correlation.
- pages/accessibility/ — single component, content selected by
                        route data (`lang: 'fr' | 'en'`). Mounted
                        at /accessibility (en) and /accessibilite
                        (fr). v1 carries placeholder copy
                        explicitly framed as "awaiting APF user
                        panel review" — RGAA + ADR-0016 require
                        the routes to exist; the substantive
                        statement (audit grid, gaps list,
                        remediation plan) lands separately.

Routing & wiring:

- app.routes.ts adds the three routes, all lazy-loaded.
- app.config.ts adds `provideHttpClient(withFetch())` so
  HttpClient delegates to the patched browser `fetch` and the
  W3C `traceparent` header propagates automatically (ADR-0012
  phase 2).
- nx-welcome.ts removed; app.ts no longer imports it.

Bundle budgets (apps/portal-shell/project.json):

- initial            ≤ 1 MB raw  (≈ 300 KB gzip target per ADR)
- anyScript          ≤ 300 KB raw (≈ 100 KB gzip per lazy chunk)
- anyComponentStyle  ≤ 6 KB raw  (5 KB warning floor)
- bundle "styles"    ≤ 150 KB raw

`maximumWarning == maximumError` so an overshoot fails the build
(matching `type: "error"` in spirit). Angular CLI compares raw
sizes; ADR-0017 §Confirmation is updated to record the gzip→raw
translation and the deferred follow-up that will add a CI check
on the actual gzipped transfer size (Angular has no native
gzip-mode budget).

Verified locally:
- `nx run-many -t lint test build` → 8 projects green, 12 tests
  pass for portal-shell across 5 specs.
- `nx build portal-shell --configuration=production` → initial
  bundle 326.99 KB raw / 89.82 KB transfer (gzip) — well under
  the ADR-0017 300 KB gzip target. Lazy chunks: home 2.66 KB,
  accessibility 2.90 KB.

Out of scope (separate PRs):

- Real RGAA audit content (APF user-panel review).
- Design tokens system in libs/shared/tokens.
- Reusable UI primitives in libs/shared/ui.
- User-preferences panel (ADR-0016 §"User-preferences panel").
- i18n machinery (@angular/localize) — for v1 the FR/EN copy is
  inlined and route-driven; real i18n is a separate ADR.
- env-config (Angular environment.ts) — DATABASE-of-the-front
  hard-coded URL `http://localhost:3000/api/health` will move
  there alongside the OTLP endpoint when the env-config PR
  lands.
- CI gzip-transfer-size assertion to complement the raw-size
  Angular budgets.

docs/decisions/0017-performance-budgets-lighthouse-ci.md

@@ -209,7 +209,7 @@ No browser-side RUM SDK in v1. The OTel browser tracing from [ADR-0012](0012-obs
 ### Confirmation
 
 - `lighthouserc.js` exists at the repo root with the critical-routes list, the assertions matching the thresholds above, and a 3-iteration median configuration.
-- `apps/portal-shell/project.json` declares `budgets` of type `"error"` with the values above.
+- `apps/portal-shell/project.json` declares `budgets` with `maximumWarning == maximumError` (so an overshoot fails the build, matching `type: "error"` in spirit). Four entries: `initial` (≤ 1 MB raw), `anyScript` (≤ 300 KB raw), `anyComponentStyle` (≤ 6 KB raw, with 5 KB warning floor), `bundle name=styles` (≤ 150 KB raw). Angular CLI compares **raw** sizes; the values above are translated from the gzip-based ADR targets at the conventional ≈ 3× JS / ≈ 4× CSS compression ratios. A future follow-up will add a CI check that asserts the **actual** gzipped transfer size against the ADR thresholds — Angular CLI does not natively support a gzip-mode budget.
 - `package.json` exposes `ci:perf`, runnable locally with the same exit code as CI.
 - CI's `perf` gate from [ADR-0015](0015-cicd-gitea-actions.md) calls `pnpm ci:perf`. It is blocking on human PRs and on `push` to `main`; skipped on PRs authored by the Renovate bot user (`apf-portal-bot`) per the gating-policy subsection above.
 - `apps/portal-shell` exposes a Nx target `analyze` invoking `source-map-explorer` against the production build's source maps.