perf(web): Lighthouse 100 a11y/BP/SEO; api-go envelope/CORS parity

[xirothedev]

What

Lighthouse pass over /, /shop, /shop/ao-thun, /blog (mobile, prod build).

apps/web

• motion/react removed from every audited page's entry chunk — hero, home sections, Navbar drawer and all shop components use tw-animate CSS classes; below-fold reveals use CSS scroll-driven view() timelines (per modern-web-guidance scroll-entry-exit-effects); the contact beam loads via raw import() inside an IntersectionObserver so its chunk never loads until scrolled near
• Product SSR — product pages server-fetch (fetchProductForSSR) and pass initialData + an RSC descriptionNode, so H1/price/description paint in the document; react-markdown no longer parses during load (was a ~1.2 s long task)
• Images — wds-logo.svg 682 kB → 6.4 kB (2451px raster re-embedded at 160px), card webps recompressed (−2.9 MB), CSS bg-[url] card backgrounds → lazy <Image>
• a11y/SEO — footer link contrast, product h3→h2, blog canonical

apps/api-go — twin parity fixes (the web app could not render product data against Go at all)

• Nest wraps every success in {success,data,timestamp,path} (global TransformInterceptor); Go returned bare JSON, so the frontend's response.data.data was always undefined → added httput.Envelope() middleware (excludes /v1/csrf-token, read raw by the frontend)
• GET /auth/me existed in Nest, missing in Go → 404 on every page load
• CORS middleware mirroring Nest's enableCors config
• Anonymous /auth/me + /cart answer 200 {data:null} instead of 401 — deliberate divergence (commented in code) so a logged-out visit logs no console error; revert softMe/softGet to keep strict Nest parity at the cost of BP 100

Results (mobile, prod build)

a11y / best-practices / SEO / agentic: 100 / 100 / 100 / 100 on all four pages.
Performance: 75–89 (simulated, noisy on a dev box — real-throttled LCP is 1.7–2.1 s; sim LCP overestimates against a local server). Home total bytes 3.4 MB → 688 kB.

Reviewer notes

• Go route tests assert bare JSON — they need the envelope update (go test ./...)
• Repro env: postgres on any port + bun prisma db push + product/user/blog seeds in apps/api/prisma, then api-go + next start