Story-1480 EPIC-030 Query runtime

Admin now has the TanStack Query runtime shell.

This walkthrough is for reviewers checking that the generated hooks from Story-1478 now have a mounted runtime provider, without migrating any page to client-side hooks yet.

What Changed

src/lib/query/client.ts creates a TanStack QueryClient with the same defaults as the app surface: no focus refetch, 30 second stale time, one query retry, and no mutation retry.
src/lib/query/provider.tsx is the only new client island. It wraps children in QueryClientProvider and uses a browser singleton while creating fresh server-side clients.
src/lib/query/invalidation.ts mirrors the app invalidation helpers for Kubb query keys headed by { url: ... }.
src/app/(admin)/layout.tsx mounts QueryProvider around AdminAppShell after the existing checkAdminMe() gate.

What Did Not Change

The root ClerkProvider and NuqsAdapter order remains intact in src/app/layout.tsx. No page was migrated to generated hooks, no /api/internal/* route was added, no Zustand store was introduced, and src/gen was not regenerated.

Observability

Per pramaan-docs ADR-104 and pramaan-docs ADR-124, this Story is instrumentation-exempt. It wires a client cache provider and invalidation helpers only; it does not add a new upstream call path, route handler, workflow, or tracer boundary. Admin tracing remains confined to src/proxy.ts and src/lib/gateway.ts.

Reviewer Checks

Expected result: the authenticated admin layout still renders through the same Clerk, checkAdminMe(), NuqsAdapter, and AdminAppShell chain, with TanStack Query context now available for future Story-1481 page migration work.