fix(cloud/frontend): repair /login render — broken inherits prebundle crashes React tree

The Cloud Tests > playwright job's 4 chronic failures (and the entire
broken /login render in dev) trace to a single Vite/rolldown
optimizeDeps issue with the `inherits` polyfill.

Repro (verified locally with Chrome devtools):
- /login mounted briefly, then crashed with
    TypeError: require_inherits_browser is not a function
        at .../elliptic-XXX.js
- Result: blank black page, "Welcome back" heading and
  `you@example.com` placeholder never rendered.

Root cause:
1. `inherits/inherits.js` (the npm main entry) does
       try { module.exports = require('util').inherits }
       catch { module.exports = require('./inherits_browser.js') }
   Vite's `util` alias is an empty shim, so the catch path runs —
   but rolldown's CommonJS prebundle for the elliptic graph hoists
   the consumer call sites *before* `require_inherits_browser`'s
   wrapper definition, throwing on first crypto access.
2. The same prebundle hoists `require_inherits` reference for
   nested elliptic submodules before its wrapper is wired up.

Fix:
- Resolve `inherits` directly to a self-contained `inherits.cjs`
  browser shim — bypasses the try/catch entirely so the catch
  path's require chain never enters the prebundle.
- Add the entire crypto graph (elliptic + inherits + hash-base +
  create-hash + create-hmac + browserify-sign + secp256k1) to
  `optimizeDeps.include` so rolldown bundles them as a single
  deterministic chunk with wrappers at top-level.

Verified: /login now renders the full Steward login section
(Welcome back heading, email input, Passkey/Magic Link/Ethereum/
Solana buttons) with zero console errors.

This unblocks the 4 chronic Cloud Tests > playwright failures:
- auth-routing > login renders without page errors when returnTo
  is provided
- public-pages > /login renders the Steward login page
- public-pages > /login Terms link reaches React Router terms
- steward-wallet-auth > Ethereum wallet sign-in signs through
  Steward and redirects to dashboard

…and by extension NPM Release, which has been gated on Cloud
Tests success.

Replaces a dropped TypeScript shim with a CommonJS one because the
file is consumed via `require()` from optimized-deps wrappers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Shaw

cloud/apps/frontend/src/shims/inherits.cjs

@@ -0,0 +1,38 @@
+// Browser-safe shim for the `inherits` npm package.
+//
+// The upstream `inherits.js` main entry tries `require('util').inherits`
+// first and falls back to `inherits_browser.js` inside a try/catch. Vite
+// aliases `util` to an empty shim, so the real path is the fallback —
+// but rolldown's optimizeDeps prebundle has trouble wiring that fallback
+// through the wrapped CommonJS module. Result: at runtime
+// `require_inherits_browser` is undefined and elliptic / hash-base /
+// create-hash crash, taking the React tree down with them on /login.
+//
+// This file is the body of `inherits_browser.js` exposed as a single CJS
+// module, so vite resolves to a known-good entry every time.
+
+if (typeof Object.create === "function") {
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor;
+      ctor.prototype = Object.create(superCtor.prototype, {
+        constructor: {
+          value: ctor,
+          enumerable: false,
+          writable: true,
+          configurable: true,
+        },
+      });
+    }
+  };
+} else {
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor;
+      var TempCtor = function () {};
+      TempCtor.prototype = superCtor.prototype;
+      ctor.prototype = new TempCtor();
+      ctor.prototype.constructor = ctor;
+    }
+  };
+}

cloud/apps/frontend/src/shims/inherits.ts

@@ -109,20 +109,37 @@ export default defineConfig(({ mode }) => {
       // Avoid scanning the giant transitive graph from packages/lib at
       // dev-server boot.
       entries: ["src/main.tsx"],
+      // Force-include the crypto graph so vite/rolldown's optimizer wires
+      // every CommonJS `require_*` wrapper before any consumer call site.
+      // Without this, the prebundle for elliptic/hash-base/create-hash
+      // ends up referencing `require_inherits` before its wrapper is
+      // defined (a known rolldown CJS hoisting issue), which crashes the
+      // React tree on /login. Pre-bundling them as a unit forces the
+      // wrappers into deterministic top-level position in the chunk.
+      include: [
+        "elliptic",
+        "inherits",
+        "hash-base",
+        "create-hash",
+        "create-hmac",
+        "browserify-sign",
+        "secp256k1",
+      ],
     },
     resolve: {
       alias: [
-        // The `inherits` shim's main entry tries `require('util').inherits`
-        // first, then falls back to `./inherits_browser.js`. Our `util`
-        // alias is the empty shim, so the require'd module is `{}` and the
-        // fallback path runs — but rolldown / esbuild's optimizeDeps
-        // prebundle has trouble wiring that fallback through the wrapped
-        // CommonJS module. The bundle ends up calling
-        // `require_inherits_browser` before the wrapper is defined, which
-        // throws inside elliptic / hash-base / create-hash and crashes the
-        // React tree on /login. Resolve `inherits` to a self-contained
-        // browser shim instead.
-        { find: /^inherits$/, replacement: r("./src/shims/inherits.ts") },
+        // The upstream `inherits` package's main entry tries
+        // `require('util').inherits` first and falls back to
+        // `inherits_browser.js` inside a try/catch. Vite aliases `util`
+        // to an empty shim, so the real path is the fallback — but
+        // rolldown's CommonJS optimizeDeps prebundle ends up referencing
+        // `require_inherits_browser` before its wrapper is hoisted, which
+        // throws inside elliptic / hash-base / create-hash and crashes
+        // the React tree on /login. Resolve `inherits` directly to a
+        // browser-safe shim so the try/catch never runs at all. Pairs
+        // with the `optimizeDeps.include` block above which forces the
+        // crypto graph to bundle as a single deterministic chunk.
+        { find: /^inherits$/, replacement: r("./src/shims/inherits.cjs") },
         // Real Buffer polyfill — Solana wallet adapters, viem, ethers, base64
         // helpers all depend on Buffer. Stubbing it throws at runtime as soon
         // as any browser-reachable code path constructs a Buffer.