fix: build constructive-app template as a static export

[marslavish]

Makes nextjs/constructive-app build as a static export and fixes the template gaps found while deploying a generated app to the static site gateway.

Gaps fixed

Static export config (next.config.ts)
Repro: pnpm build produced a server build; the static site gateway needs out/. Turbopack also mis-inferred the workspace root in the generated pnpm monorepo.
Impact: generated apps could not deploy as static sites.
Fix: output: 'export', images: { unoptimized: true }, and a turbopack.root that walks up to the nearest pnpm-workspace.yaml, so the path resolves both standalone in this repo and as packages/app in a generated monorepo.

pnpm 11 global virtual store (pnpm-workspace.yaml)
Repro: with pnpm 11 defaults, Turbopack resolves next outside the workspace and rejects it.
Impact: pnpm dev/pnpm build fail in fresh checkouts.
Fix: enableGlobalVirtualStore: false.

Install is broken out of the box (found while verifying)
Repro: pnpm install exits 1 with ERR_PNPM_IGNORED_BUILDS; pnpm 11 ignores the pnpm field in package.json, and the committed allowBuilds values were literal set this to true or false placeholders.
Impact: no script (lint:types, build, dev) can run.
Fix: moved the graphql override into pnpm-workspace.yaml, set allowBuilds to real values, removed the dead pnpm field.

Dynamic org routes cannot static-export (route conversion)
Repro: src/app/orgs/[orgId]/* has no generateStaticParams; next build with output: 'export' fails (and [] would export routes that 404 on a static host).
Impact: the B2B org surface blocks the static export entirely.
Fix: converted to query-param routes per this PR's own convention doc — /orgs/{members,invites,settings,activity}?orgId=…, useEntityParams reads orgId via nuqs useQueryState, buildOrgRoute builds the links, sidebar configs and callers updated. Side effect: the org routes now match getRouteKeyFromPath, so their access: 'protected' guard actually applies (the bracket paths never matched).

Shell scroll (app-shell.tsx)
Repro: <main> was overflow-hidden, so every page needed its own h-full overflow-y-auto wrapper; pages without one could not scroll.
Impact: nested scroll containers and easy-to-miss unscrollable pages.
Fix: <main> is overflow-y-auto; removed the per-page wrappers.

Query retry predicate (src/lib/query-client.ts)
Repro: SDK hooks throw plain TypeError on network failure and GraphQLRequestError with an HTTP 5xx message on gateway hiccups; the predicate retried neither.
Impact: transient infra errors surface as hard failures.
Fix: retry both (5xx only for GraphQLRequestError).

Conventions doc (docs/CONVENTIONS.md, linked from the README)
New: no [param] routes (query-param detail routes with Suspense instead), create/edit via stack cards, every query error state renders a refetch() retry control, scrolling lives in the shell. docs/B2B.md route references updated to match.

Build runs codegen when the SDK is absent (scripts/ensure-sdk.sh)
Repro: pnpm build fails in a checkout without the generated SDK (the repo commits only stub src/graphql/sdk/*/index.ts; the generated dirs are gitignored).
Impact: generated apps need a manual pnpm codegen step before the first build.
Fix: build runs ensure-sdk.sh, which runs codegen only when src/graphql/sdk/*/types.ts is missing, and skips it when a generated SDK is present.

Out of scope

• Endpoint hostnames belong in .env.local handling in @agentic-kit/pi (scaffolder), not this template.
• The pnpm-workspace.yaml placeholder writer is scaffolder-side (@agentic-kit/pi); this PR only fixes the copy committed here.
• The generated SDK typing unknown for some fields is in @constructive-io/graphql-codegen, not chased here.

Verification

• pnpm install passes (it exits 1 on main).
• pnpm lint:types: 0 errors with a generated SDK in place. Without one, main and this branch fail with the identical 52 stub-SDK errors (sorted lists diff clean) — this PR adds no type errors.
• pnpm build with a generated SDK and NEXT_PUBLIC_DB_NAME set: all 20 routes prerender as static content into out/, including the four converted /orgs/* routes (their HTML contains the Suspense shell skeleton, confirming the nuqs query-param reads are prerender-safe).
• ensure-sdk.sh guard exercised both ways against a fixture tree (runs codegen when a types.ts is missing, skips when present).
• Not verified (needs a live backend, none was available): shell scroll behind auth in pnpm dev, the 5xx retry against a real gateway, and org navigation end to end. Static checks for these pass; runtime behavior needs a backend.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.