Replace generated server actions with typed better-call endpoints

.gitignore

@@ -55,4 +55,7 @@ apps/web/.data/
 HANDOFF.md
 
 # build
-**/dist/
+**/dist/
+
+# Local research notes
+/docs/research/**/*.md

CONTEXT.md

@@ -277,7 +277,7 @@ _Avoid_: **Organiser Approval** queue, **Hackathon Capacity**, automatic accepta
 -   Early **HackKit Web App** implementations may use guided “next step” links without hard redirects between onboarding steps; strict step enforcement may come later.
 -   **HackKit UI** may provide a **Competitor Onboarding Progress** component that displays step labels and completion state from props supplied by the **HackKit Web App** (no hard redirects).
 -   **HackKit Web Apps** may expose each **Competitor Onboarding** step at its own route under a shared prefix (for example `/onboarding/...`).
--   **HackKit UI** ships default forms for **Competitor Onboarding** steps, including **HackTag** claim, **User Data**, and **Hacker Registration**; **HackKit Web Apps** wire routes, server actions, and adapters.
+-   **HackKit UI** ships default forms for **Competitor Onboarding** steps, including **HackTag** claim, **User Data**, and **Hacker Registration**; **HackKit Web Apps** wire routes, a typed browser path client, and adapters.
 -   **Hacker Registration** resume uploads use a **Blob Storage Adapter** in the **HackKit Web App**; **HackKit Core** stores only the **Stored File Reference** on the **Hacker** record when provided; omitting a resume leaves `resumeUrl` unset (no sentinel placeholder).
 -   A **Hacker** belongs to exactly one **User**.
 -   A **Hacker** may have zero or one **Group**.

apps/web/README.md

@@ -8,12 +8,12 @@ Use Node.js 22.17 or newer and pnpm 8.3.1. Run these commands from the repositor
 
 1. Install dependencies with `pnpm install`.
 2. Build workspace packages with `pnpm exec turbo run build --filter=web^...`.
-3. Sync plugin routes and actions with `pnpm --filter web sync`.
+3. Sync plugin routes with `pnpm --filter web sync`.
 4. Apply committed migrations with `pnpm --filter web db:migrate`.
 5. Insert configured roles with `pnpm --filter web db:seed`.
 6. Start Next.js with `pnpm --filter web dev`.
 
-Development defaults use `http://localhost:3000`, SQLite at `apps/web/.data/web.db`, and local blob storage. OAuth, email, and Discord providers are optional locally. The runtime does not migrate or seed on startup. Plugin sync only updates routes, actions, and `hackkit.lock`.
+Development defaults use `http://localhost:3000`, SQLite at `apps/web/.data/web.db`, and local blob storage. OAuth, email, and Discord providers are optional locally. The runtime does not migrate or seed on startup. Plugin sync only updates routes and `hackkit.lock`.
 
 After signup, bootstrap an owner explicitly by assigning `core.owner` to that user's `role_id` in `core_user`, selected by `id`. Better Auth's `user.id` is the canonical ID. The runtime does not infer ownership from email.
 
@@ -51,7 +51,7 @@ The database commands now use application-owned utility scripts, independently o
 
 [lib/auth-options.ts](lib/auth-options.ts) supplies secrets, origins, and OAuth providers. Core owns Better Auth construction, native entities, and the pinned community adapter. Better Auth identity and HackKit profile fields share the canonical `core_user` row.
 
-[lib/runtime.ts](lib/runtime.ts) initializes shared connections and registers a function that creates request-scoped domain APIs. Next owns cookies, headers, guards, and redirects. Server actions return plain DTOs. Browser code uses `@hackkit/core/client`; it does not import the ORM.
+[lib/runtime.ts](lib/runtime.ts) initializes shared connections and registers a function that creates request-scoped domain APIs. Next owns cookies, headers, guards, and redirects. Browser mutations use the package-owned HTTP handler and return JSON DTOs. Browser code uses `@hackkit/core/client`; it does not import the ORM.
 
 ## Production configuration
 
@@ -83,4 +83,4 @@ The matrix writes test accounts and domain records; it never drops the target da
 -   [hackkit.config.ts](hackkit.config.ts): plugins, database, auth, settings, and seed roles.
 -   [db/migrations](db/migrations): reviewed app-owned migrations.
 
-UI mutations and `hackKitUIActions` ship from `@hackkit/next`. Plugin server actions in `app/hackkit-plugin-actions.ts` are generated by `hackkit plugin sync` and share the same request runtime.
+The UI provider receives a typed better-call path client created at module scope in `app/providers.tsx`. Plugin components bind their endpoint types using the provider's HTTP settings. `hackkit plugin sync` installs page reexports and updates `hackkit.lock`; it generates no client metadata. The single `/api/hackkit/[...path]` route forwards POST to the host handler. No app-level action wrappers or action maps are needed.

apps/web/app/api/hackkit/[...path]/route.ts

@@ -0,0 +1,4 @@
+import { handleHackkitRequest } from "@/lib/runtime";
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+export const POST = handleHackkitRequest;

apps/web/app/providers.tsx

@@ -1,21 +1,12 @@
+"use client";
 import { HackKitUIProvider } from "@hackkit/ui";
+import { createHackkitClient } from "@hackkit/core/http/client";
 import type * as React from "react";
-import { hackKitUIActions } from "./_hackkit/ui-action-map";
 
-/**
- * Wires Core mutations through HackKit actions. Those actions import the app
- * runtime before resolving a mutation, which is required for Server
- * Action requests that do not execute a page module first.
- *
- * Do not pass `DEFAULT_HACKKIT_UI_ROUTES` (or any map with route builder
- * functions) from this Server Component — those builders are not serializable.
- * Omit `routes` to use the client-side defaults, or pass only string overrides.
- * For custom admin builders, supply a client `navigation` adapter instead.
- */
+const hackkitClient = createHackkitClient();
+
 export function Providers({ children }: { children: React.ReactNode }) {
 	return (
-		<HackKitUIProvider actions={hackKitUIActions}>
-			{children}
-		</HackKitUIProvider>
+		<HackKitUIProvider client={hackkitClient}>{children}</HackKitUIProvider>
 	);
 }