feat(page-money): mock/live harness toggle + scenario controls + loud banner

[ZacxDev]

What

Layer 1 of the App Blocks local-dev DX, template half. Makes the page-money template's mock host the obvious, safe-by-default mode, exposes the new createMockHost scenario controls in the harness, and wires (but does not fake) an opt-in live mode. Companion to the SDK PR that adds the scenarios: civitai/civitai-app-starters#54.

Changes

• Mock is the default + LOUD. dev:harness stays mock; a fixed 🧪 MOCK HOST · no real Buzz spent · no real compute banner is always on screen.
• Opt-in live mode (npm run dev:live / VITE_HARNESS_MODE=live), loudly warned (⚠️ LIVE — spends REAL Buzz / real compute). Live reads a real block token (VITE_LIVE_BLOCK_TOKEN) + target origin (VITE_LIVE_HOST_ORIGIN).
  • Live is a wired STUB. A true live proxy-host needs a server dev-token endpoint — that's Layer 2, not built yet. So live fails safe: resolveLiveConfig() returns ready:false (with a clear reason) unless BOTH a token AND VITE_LIVE_PROXY_READY=true are set, and main.tsx renders a clear "not yet available" notice instead of silently spending or breaking. The env reads + mode switch are wired so it lights up the moment Layer 2 lands. It does not fake "live" as mock.
• Scenario controls, two ways:
  • an on-screen dev-only scenario panel (top-left): force insufficient Buzz, fail next generation, 50% failure rate, simulated balance, latency — flip live, no reload;
  • URL params: ?balance / ?fail / ?latency (2000 or 500-2000) / ?costPerGen / ?failNext / ?failRate — mapping to the new generation / buzz SDK options.
• Dep bumps: @civitai/blocks-react ^0.8.0 → ^0.10.0, @civitai/app-sdk ^0.12.0 → ^0.13.0.
• README: "Mock vs live" section + scenario tables + the publish-sequencing note.

⚠️ Sequencing — merge AFTER the SDK publishes

ci.yml's rot-guard scaffolds the template and runs npm install against the published @civitai/blocks-react. This PR pins ^0.10.0, which doesn't exist on npm until civitai-app-starters#54 is merged + its Version Packages PR publishes 0.10.0. So Part B's CI is green only after Part A publishes — merge this PR after that publish (the pinned ^0.10.0 is exact-targeted to the minor bump from #54).

Verification

The new SDK version isn't on npm yet, so I verified locally by npm pack-ing the Part A build and installing the tarballs into a freshly-scaffolded project:

• civitai app init … --template page-money — scaffolds clean (Go templating valid; all inline styles moved to named CSSProperties consts to avoid the {{ }} collision).
• tsc -p tsconfig.json --noEmit — green.
• vitest run — 14 passed (incl. the e2e estimate→consent→submit→poll money-path proof) against the new SDK.
• vite build — green.
• go test ./... — all packages pass (scaffold + cmd).

Real vs stub: mock mode + scenarios are fully real and exercised. live mode is a wired stub that fail-safes pending Layer 2 (the server dev-token endpoint / live proxy-host).

🤖 Generated with Claude Code