refactor: convert to bun workspaces monorepo

- Move web app into apps/web/
- Create packages/shared/ with shared types
- Create plugins/decky-vault/ scaffold
- Root package.json manages workspaces only

apps/web/lib/auth/domain-block.ts

@@ -0,0 +1,18 @@
+export const DOMAIN_BLOCK_ERROR =
+  "Signing up with a @deckyvault.xyz email is not allowed."
+
+/**
+ * Returns true if the email address has a deckyvault.xyz domain.
+ * Handles case-insensitive comparison, whitespace trimming, and
+ * plus-notation aliases (user+tag@domain → domain).
+ *
+ * Only matches the exact domain "deckyvault.xyz" — NOT subdomains
+ * like "mail.deckyvault.xyz".
+ */
+export function isDeckyVaultEmail(email: string): boolean {
+  const trimmed = email.trim().toLowerCase()
+  const atIndex = trimmed.lastIndexOf("@")
+  if (atIndex === -1) return false
+  const domain = trimmed.slice(atIndex + 1)
+  return domain === "deckyvault.xyz"
+}