Cleanup: delete dead code, fix invalidateFunctions bug, deduplicate

Deleted:
- runtime/index.ts (146 lines) — never imported by anything
- httpFunctionCall + _csrClient cache — redundant third HTTP path
- 3 duplicate getCSRFToken() implementations → shared utils.ts

Fixed:
- invalidateFunctions() was ignoring function names and invalidating
  ALL mounted contexts. Now correctly passes names through.

33 React tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/mizan-react/src/utils.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared utilities used across mizan-react.
+ */
+
+/** Extract CSRF token from cookies. Returns null during SSR. */
+export function getCSRFToken(): string | null {
+    if (typeof document === 'undefined') return null
+    const match = document.cookie.match(/csrftoken=([^;]+)/)
+    return match?.[1] ?? null
+}