feat(examples): add saas tutorial skeleton

Add a compile-tested v1 tutorial skeleton that proves the production-shaped app boundary without provider-heavy scope: auth/session context, CSRF-checked mutation, local persistence adapter, generated form/slot/keyed row/page/push effects, plain CSS, SSE shape, and one explicit metrics island.

req: examples/001

req: auth/001

req: auth/002

req: auth/004

req: form/001

req: failure/004

req: page_swap/002

req: push/003

examples/saas/README.md

@@ -0,0 +1,27 @@
+# hemx SaaS tutorial skeleton
+
+This is the compile-tested skeleton for the v1 production-shaped tutorial app. It is intentionally provider-light: auth/session, CSRF, persistence, deploy, metrics, and islands are explicit app boundaries, not hemx core services. req: examples/001 req: auth/001
+
+What it proves today:
+
+- typed form/newtype inputs for project creation
+- auth/session context passed through normal Rust state
+- CSRF-safe mutation checked before persistence
+- local in-memory persistence adapter instead of a vendored SQL/auth provider
+- generated form, slot, keyed row, page-swap, and live-status commands
+- page shell with plain CSS and one explicit metrics island script
+- compile-time surface generation plus interaction tests
+
+What it deliberately does not claim yet:
+
+- real SQLx migrations or a database pool
+- production cookie/session middleware
+- a deploy target, flags, analytics, billing, or offline sync
+- browser automation for the metrics island
+
+Run:
+
+```sh
+cargo run -p hemx-saas-example
+cargo test -p hemx-saas-example
+```