feat(04-01): install new deps + scaffold API test harness with Wave-0 RED stubs

- Add react-router@7, @dnd-kit/core, @dnd-kit/sortable, fractional-indexing to PWA
- Add fractional-indexing to API (rank generation server-side)
- ioredis NOT added (in-memory EventEmitter per RESEARCH Plan 02 justification)
- Create apps/api/test/setup.ts with afterEach DB cleanup for list tables
- Wire test.setupFiles in apps/api/vitest.config.ts
- Add 4 Wave-0 RED stub test files (LIST-01/02/03/04, D-04, D-11, D-07)
- All stubs run as todo, not import-error

apps/api/src/lib/listEmitter.test.ts

@@ -0,0 +1,19 @@
+/**
+ * Wave-0 RED stubs for listEmitter (in-memory EventEmitter fan-out).
+ *
+ * Covers D-04: SSE fan-out MUST be scoped to who can see a list.
+ * These are pure-unit tests — no DB or HTTP server needed.
+ *
+ * Downstream plans implement the actual listEmitter.ts module that these stubs test.
+ *
+ * Run: pnpm --filter @familysync/api test
+ */
+
+describe('listEmitter — scoped fan-out correctness (D-04)', () => {
+  it.todo('publishListEvent emits only to subscribers for the matching listId')
+  it.todo('publishListEvent does NOT emit to subscribers for a different listId')
+  it.todo('subscribeListEvents returns an unsubscribe function that stops future events')
+  it.todo('unsubscribed handler is not called after unsubscribe()')
+  it.todo('multiple subscribers for the same listId all receive the event')
+  it.todo('emitter handles 100+ concurrent subscribers without error (D-18 scale check)')
+})