feat: strengthen SSR federation (dev parity, shared strategy, resilience)

[Nsttt]

Summary

Strengthens the module's SSR federation so remote components are truly server-rendered wherever the toolchain allows it, and degrade predictably where it doesn't.

Changes

• ssr module option (default true) replaces the hard !nuxt.options.dev gate. Server federation is now controlled by the option and the app's ssr setting, not by dev vs prod.
  • Dev mode checks the installed Vite version: the @module-federation/vite ssrEntryLoader dev path (ModuleRunner over /__mf_runner__) requires Vite 8+, and on Vite 7 it deadlocks the SSR render (verified empirically). On Vite 7 (current Nuxt) dev falls back to client-only remotes with an info log; when Nuxt ships Vite 8 next minor, dev upgrades to real MF SSR automatically.
• shared-strategy runtime plugin (new @module-federation/nuxt/shared-strategy export) forcing loaded-first on all shared deps, injected into both the client and server federation configs, so an already-loaded shared module (e.g. the host's Vue instance) is reused across remotes instead of re-negotiated.
• Unified config assembly: one config source patched per target via patchMFConfig(config, isServer) with runtime-plugin injection/dedupe. Configs stay lazy inside the Vite plugin factories because exposed components are collected by Nuxt hooks after module setup.
• Shared-version mismatch warnings at build time: the Vite server side aliases shared packages to the host's installed copies with no share-scope negotiation, so divergence between host and remote versions is now surfaced instead of silent.
• Graceful SSR failure fallback: if a remote can't be loaded during SSR, the server logs a warning and renders nothing for that component instead of failing the whole response; the client renders it after hydration.
• Fix: missing CORS headers on the root-level remoteEntry.js copy that the rebased manifest points browsers at (pre-existing bug on main; client-side federation failed with RUNTIME-015 in the browser while all curl-level checks passed).

Verification

Playwright (Chromium) against the example apps:

• Prod (6/6): remote Widget/Counter markup present in the raw SSR HTML, both components visible after hydration, no hydration mismatch warnings, no console errors, buttons interactive.
• Dev on Vite 7 (4/4): SSR responds in ~400 ms (no hang), remote components correctly deferred and mounted client-side, no console errors.

Plus tsc --noEmit, package build, and full builds of both example apps.

Caveat

The dev-mode true-MF-SSR path is implemented but can't be exercised until Nuxt ships Vite 8 — it should be re-verified in dev when that lands.