refactor!: remove legacy Confidence API and replace React integration

[andreas-karlsson]

Summary

Remove the stateful Confidence API and its implementation. The SDK now exposes the stateless ConfidenceClient, pure FlagBundle evaluation, evaluation-context/logger types, and browser flag-evaluation reporting. The OpenFeature providers continue to use the thin client.

Delete the legacy resolver/event engines, cache and observer infrastructure, automatic trackers, telemetry code/proto, and associated tests. Replace the legacy React integration with bundle-based ConfidenceProvider, useFlag, and useFlagDetails. Keep fetching and exposure transport application-owned: the same hooks accept thin-client callbacks or server actions. Retire the old server entry point and Next.js development patch.

Migrate the Node ESM/CommonJS and React 18/19 examples, update public API reports and migration documentation, and restore React to builds, release automation, package verification, and hook linting. Align the shared bundle reason/error vocabulary with the local resolver; switching that separate repository's React imports is follow-up work. Tokens remain backend-specific.

Compatibility and release

This PR is stacked on #461; its base is migrate-to-stateless-client so the diff shows the legacy API removal and React replacement.

Target SDK 0.5.0 and React 0.3.0, with explicit release versions. This preserves the 0.4 compatibility boundary for the legacy React package from #461. Providers support >=0.4.0 <0.6.0 because their thin-client API remains compatible. React 0.3 requires SDK >=0.5.0 <0.6.0; legacy React consumers must migrate to the bundle/provider API before adopting SDK 0.5.

Validation

• 171 SDK/provider/React tests passed, including a React 18/19 runtime matrix covering StrictMode deduplication, manual exposure, failed-write retries, defaults/errors, bundle changes, SSR, and hydration.
• All 36 remaining live E2E tests and 216 CSR tests passed on the preceding removal commit; React replacement does not change their transports.
• Package builds, API reports, lint (including hook rules), formatting, and workspace constraints passed. CSR build passed on the removal commit.
• React 18 and React 19 browser examples type-checked and built.
• Packed ESM/CommonJS consumer checks passed with React 18 and React 19 types, including provider/callback usage. Published React entry points preserve use client.
• Verified runtime exports contain only ConfidenceClient, FlagBundle, and publishFlagEvaluation.

✔️ Checklist

• All tests are passing
• Relevant documentation updated
• linter/style run on changed files
• Tests added for new functionality
• Regression tests added for exposure failures, duplicate effects, and hydration
• Tested in a corresponding example app (React examples type-checked/built, not manually browser-tested; hooks exercised under jsdom)