feat(console): introduce TanStack Query for client data fetching

[jeroenrinzema]

Why

The console's client-side data fetching is currently split across two patterns: React Router loaders for route-level data, and a homegrown useResolver hook for in-component fetching. useResolver has no caching, no request dedup, no background revalidation, and no mutation→invalidation wiring — every list view re-implements pagination by hand and refreshes after writes with an imperative reload().

This PR introduces TanStack Query as the console's caching data layer and migrates the Users list view as the reference pattern. The remaining ~17 list views keep working unchanged and can adopt the same approach incrementally.

This is the first slice of the TanStack assessment — Query is the highest-leverage piece. Router (we're on React Router 7) and Form (react-hook-form) are intentionally left as-is.

What's in here

Infrastructure

• lib/query-client.ts — shared QueryClient with dashboard-tuned defaults (30s staleTime, single retry, focus revalidation).
• lib/query-keys.ts — centralised, hierarchical query-key factory so a mutation can invalidate lists and detail views by prefix.
• App.tsx — mounts QueryClientProvider; React Query Devtools enabled in dev only.

Users view migration

• Swaps useResolver for useQuery with keepPreviousData, so paging and typing in search no longer flash an empty table.
• Converts user creation and bulk import to useMutation, refreshing the list via cache invalidation instead of reload().
• isCreating is now derived from mutation.isPending — one less piece of manual state.

Notes / follow-ups

• Loaders are deliberately untouched; the clean end-state is Query as the single content layer with loaders reduced to thin auth/redirect guards.
• Suggested next steps: adopt the same pattern in the other useResolver-based list views, and consider a shared useSearchQuery helper to remove the per-view pagination boilerplate.

Verification

• tsc --noEmit clean
• eslint clean on changed files
• pnpm build succeeds (only pre-existing chunk-size / dynamic-import warnings)