feat(tlsync): fetch short-lived token from API before multiplayer connect

- Remove VITE_TLSYNC_SECRET from browser env (no longer exposed to bundle)
- Add useTlsyncToken hook that fetches /api/tlsync/token with Supabase auth
- Extract TldrawCanvas sub-component: only renders after token is ready
- Pass API-issued short-lived token to createSyncConnectionOptions
- Add vite.config.ts blocklist to prevent secret leak (defense-in-depth)
- Remove VITE_TLSYNC_SECRET from .env.example (server-side only now)

Related: t_a69128a1 (API token endpoint), t_41a844a7 (this task)

vite.config.ts

@@ -14,9 +14,11 @@ export default defineConfig(({ mode }) => {
 
   // Determine client-side env vars to expose
   const envPrefix = 'VITE_'
+  // Defense-in-depth: never expose server-only secrets to the browser bundle
+  const envBlocklist = new Set(['VITE_TLSYNC_SECRET'])
   const clientEnv = Object.fromEntries(
     Object.entries(env)
-      .filter(([key]) => key.startsWith(envPrefix))
+      .filter(([key]) => key.startsWith(envPrefix) && !envBlocklist.has(key))
       .map(([key, value]) => [`import.meta.env.${key}`, JSON.stringify(value)])
   )