Phase 4: embed UI into kamado-api binary

The production image is now a single Go binary that serves both the
JSON/WebSocket API under /api and the Svelte dashboard at /.

- New internal/webui package embeds a dist/ subdir via //go:embed.
  A placeholder index.html is committed so `go build` works on a
  fresh checkout; anything else in dist/ is regenerated per build
  and gitignored.

- httpapi.Server.Handler mounts the embed.FS at / with SPA-style
  fallback: unknown non-/api paths serve index.html so client-side
  routes survive a reload. /api/* is carved out explicitly so POSTs
  or typos never accidentally shadow API semantics with HTML.

- api/Dockerfile grows a node:22 builder stage that runs
  `npm ci && npm run build`, and the Go stage copies ui/dist/ into
  internal/webui/dist/ before `go build`. Build context moves to
  the repo root (docker-compose + `make api` both updated) so the
  Dockerfile can see both api/ and ui/.

With this in place, `make up` brings the whole stack online at
http://localhost:8080 — API under /api, dashboard at /. The Vite
dev server on :5173 with the /api proxy is still available via
`make ui-dev` for hot-reload development.

api/Dockerfile

@@ -1,24 +1,57 @@
 # ============================================================================
-# kamado-api build stage
+# kamado-api build
+#
+# Stage 1 (ui):   Build the Svelte dashboard to ui/dist.
+# Stage 2 (go):   Build the Go binary, embedding the UI via //go:embed.
+# Stage 3 (run):  Minimal debian with tini and the static binary.
+#
+# The build context for this Dockerfile is the ./api directory by
+# default, which is fine for stage 2. But stage 1 needs the ui/
+# directory from the repo root. docker-compose sets `context: .` at
+# the repo root and `dockerfile: api/Dockerfile` to make both visible;
+# for plain `docker build ./api`, set --build-context repo=..
 # ============================================================================
+
+# ----------------------------------------------------------------------------
+# Stage 1: build the Svelte dashboard
+# ----------------------------------------------------------------------------
+FROM node:22-bookworm-slim AS ui
+
+WORKDIR /ui
+# Copy just the manifest first so npm install is cached across code
+# edits. The build context must be the repo root — docker-compose
+# uses `context: .`, and `make api` invokes docker build with the
+# repo root as context.
+COPY ui/package.json ./
+RUN npm install --no-audit --no-fund
+
+COPY ui/ ./
+RUN npm run build
+
+# ----------------------------------------------------------------------------
+# Stage 2: build the Go binary with the UI embedded
+# ----------------------------------------------------------------------------
 FROM golang:1.22-bookworm AS build
 
 WORKDIR /src
-# Cache deps first
-COPY go.mod ./
+COPY api/go.mod ./
 RUN go mod download 2>/dev/null || true
-COPY . .
+COPY api/ .
+
+# Drop the built dashboard into the embed target before `go build` so
+# //go:embed picks it up. We delete the committed placeholder first.
+RUN rm -rf internal/webui/dist && mkdir -p internal/webui/dist
+COPY --from=ui /ui/dist/ internal/webui/dist/
 
-# Static build — CGO off, stripped, reproducible-ish
 RUN CGO_ENABLED=0 GOOS=linux go build \
         -trimpath \
         -ldflags="-s -w" \
         -o /out/kamado-api \
         ./cmd/kamado-api
 
-# ============================================================================
-# Runtime: distroless-ish minimal
-# ============================================================================
+# ----------------------------------------------------------------------------
+# Stage 3: runtime
+# ----------------------------------------------------------------------------
 FROM debian:bookworm-slim AS runtime
 
 RUN apt-get update && apt-get install --no-install-recommends -y \