feat(slabs): S2 CRUD + optimistic concurrency + soft delete + slab list UI

- backend/slabs.py: create (calibrated, client-derived stored as sent), list (excl
  soft-deleted, most recent), get, update (single compare-and-set on server_rev,
  409 revision_conflict / 409 duplicate_sku / 422 stale_field, status server-derived),
  delete (soft, published rejected). Explicit column allowlists, parameterized SQL,
  JSON array fields, commits.
- backend/app.py: wire slabs router.
- frontend: src/api/slabs.ts client + create/slabs/SlabList.svelte + dev toggle.
- tests: 9 slabs tests (create/dup/list/get/update/rev-conflict/dup-sku/soft-delete/
  published-delete) with full taxonomy seeding.

Verified: pytest 23 passed; check_requirements + check_coverage exit 0; npm build ok.

frontend/src/api/slabs.ts

@@ -0,0 +1,51 @@
+// Thin client for the S2 slabs endpoints. Svelte-agnostic.
+
+export interface Slab {
+  id: string;
+  sku: string;
+  status: string;
+  price: number;
+  length_in: number;
+  thickness_in: number;
+  sqft: number;
+  bdft: number;
+  width_avg_in: number;
+  title: string | null;
+  server_rev: number;
+  created_at: string;
+  updated_at: string;
+}
+
+export class ApiError extends Error {
+  constructor(public status: number, public code: string | null, message: string) {
+    super(message);
+    this.name = 'ApiError';
+  }
+}
+
+async function parse<T>(res: Response): Promise<T> {
+  if (!res.ok) {
+    let code: string | null = null;
+    let message = res.statusText;
+    try {
+      const body = await res.json();
+      if (body?.error) {
+        code = body.error.code ?? null;
+        message = body.error.message ?? message;
+      }
+    } catch {
+      /* non-JSON body */
+    }
+    throw new ApiError(res.status, code, message);
+  }
+  if (res.status === 204) return undefined as T;
+  return (await res.json()) as T;
+}
+
+export function listSlabs(): Promise<Slab[]> {
+  return fetch('/api/v1/slabs').then((r) => parse<Slab[]>(r));
+}
+
+export function getSlab(id: string): Promise<Slab> {
+  return fetch(`/api/v1/slabs/${encodeURIComponent(id)}`).then((r) => parse<Slab>(r));
+}