Add the A4 report designer and fix band layout

Brings in the A4 (millimetre) report designer alongside the existing
matrix editor, migrates the frontend from react-scripts to Vite/Vitest,
and fixes four defects found while using the A4 band tools.

Layout — layout.js now implements the standard banded-report model:
everything prints where it was drawn, and a band growing per data row is
the only thing that moves anything. Previously `paginate` re-flowed every
band from the top margin, so a band placed halfway down the page
previewed at the top, and `header` was treated as a page header and
hoisted above the statics drawn before it. A header is a COLUMN header:
it prints in place and repeats only on a continuation page. Statics now
take part too — one drawn below a band keeps its drawn gap as that band
grows, and follows onto the next page rather than vanishing when pushed
past the bottom margin. The displacement is keyed on the band's design
bottom, not on an instance's laid-out y: every row of a band shares one
design position, so keying on the instance measured the gap from row 1
and let the static overlap rows 2..n.

Band children — a child's x is relative to its band, as its y already
was. layout() emitted it raw, so a field printed measured from the paper
edge instead of the band's left margin. Instances now carry bandX.

Band placement — a band's x comes from the page margins, so creation
takes only the click's Y (the factory's x was being overwritten by the
spread order) and dragging is locked to the vertical axis. Bands render
as a strip, with top/bottom rules only, matching the matrix editor.
fromApiReport reflows on load so reports saved with a stray x straighten
themselves. Matrix bands are constrained to vertical too.

Drag lifecycle — useElementDrag re-subscribed its document listeners on
every render during a drag, because the effect depended on an unmemoized
onDrag. Each re-subscribe removed the mouseup listener before adding the
next, measured as add/remove/add/remove/add across two mousemoves, and a
release landing in that gap was lost: the element kept following the
cursor until the next click. Snapping made it routine, since a held
guide stops x/y changing and leaves the guide overlay's render sitting
between the move and the release. onDrag and dragData now go through
refs so the effect depends on [isDragging] alone.

Note: the matrix editor has no test coverage, so its band constraint is
verified by reading only. The A4 suite is 201 passing tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/vite.config.mjs

@@ -0,0 +1,37 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+export default defineConfig({
+  // CRA's Babel loader accepted JSX inside .js files. Production sources have
+  // been renamed to .jsx, but the a4 test files are still .js containing JSX,
+  // so the transform is widened to parse .js as JSX too. This works on the
+  // dev/test path; the bundled build path derives the language from the file
+  // extension, which is why the production file had to be renamed.
+  plugins: [react({ include: /\.(js|jsx)$/ })],
+  oxc: {
+    include: /\.(m?ts|[jt]sx|js)$/,
+    exclude: /node_modules/,
+    lang: 'jsx',
+  },
+  server: {
+    // Must stay 5172 — Django's CORS_ALLOWED_ORIGINS allowlists this origin.
+    port: 5172,
+    strictPort: true,
+    // Replicates CRA's "proxy": "http://localhost:8002". The app calls the API
+    // with absolute URLs (VITE_API_URL), so this only matters as a fallback
+    // for a relative /api request.
+    proxy: {
+      '/api': 'http://localhost:8002',
+    },
+  },
+  build: {
+    // Kept as CRA's 'build' rather than Vite's default 'dist' so the existing
+    // Dockerfile (COPY --from=builder /app/build) keeps working.
+    outDir: 'build',
+  },
+  test: {
+    environment: 'jsdom',
+    globals: true,
+    include: ['src/**/*.test.{js,jsx}'],
+  },
+});