Phase 4: embed UI into kamado-api binary

The production image is now a single Go binary that serves both the
JSON/WebSocket API under /api and the Svelte dashboard at /.

- New internal/webui package embeds a dist/ subdir via //go:embed.
  A placeholder index.html is committed so `go build` works on a
  fresh checkout; anything else in dist/ is regenerated per build
  and gitignored.

- httpapi.Server.Handler mounts the embed.FS at / with SPA-style
  fallback: unknown non-/api paths serve index.html so client-side
  routes survive a reload. /api/* is carved out explicitly so POSTs
  or typos never accidentally shadow API semantics with HTML.

- api/Dockerfile grows a node:22 builder stage that runs
  `npm ci && npm run build`, and the Go stage copies ui/dist/ into
  internal/webui/dist/ before `go build`. Build context moves to
  the repo root (docker-compose + `make api` both updated) so the
  Dockerfile can see both api/ and ui/.

With this in place, `make up` brings the whole stack online at
http://localhost:8080 — API under /api, dashboard at /. The Vite
dev server on :5173 with the /api proxy is still available via
`make ui-dev` for hot-reload development.

api/internal/httpapi/server.go

@@ -4,10 +4,14 @@ package httpapi
 
 import (
 	"encoding/json"
+	"errors"
+	"io/fs"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"github.com/kamadopool/kamado-api/internal/state"
+	"github.com/kamadopool/kamado-api/internal/webui"
 )
 
 type Server struct {
@@ -20,7 +24,9 @@ func New(agg *state.Aggregator, log *slog.Logger) *Server {
 	return &Server{Agg: agg, Hub: NewHub(), Log: log}
 }
 
-// Handler returns an http.Handler with all kamado routes mounted under /api.
+// Handler returns an http.Handler with all kamado routes mounted under
+// /api and the embedded Svelte dashboard served under /. Unknown
+// non-/api paths fall back to index.html for SPA-style routing.
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /api/health", s.health)
@@ -31,9 +37,47 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/blocks", s.blocks)
 	mux.HandleFunc("GET /api/snapshot", s.snapshot)
 	mux.HandleFunc("GET /api/ws", s.handleWS)
+	mux.Handle("/", spaHandler(webui.FS()))
 	return mux
 }
 
+// spaHandler serves static files from the embedded dist tree and
+// falls back to index.html on 404 so client-side routing works. It
+// refuses anything under /api to keep the contract with mux patterns
+// explicit (those routes register their own handlers above).
+func spaHandler(root fs.FS) http.Handler {
+	fileServer := http.FileServerFS(root)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Defence-in-depth — /api routes are matched by the mux first
+		// with their GET patterns, but a bare POST /api/... would fall
+		// through here. Return 404 so we don't accidentally shadow
+		// API semantics with HTML.
+		if strings.HasPrefix(r.URL.Path, "/api/") || r.URL.Path == "/api" {
+			http.NotFound(w, r)
+			return
+		}
+
+		// Fast path: exact file exists in the embed.
+		clean := strings.TrimPrefix(r.URL.Path, "/")
+		if clean == "" {
+			clean = "index.html"
+		}
+		if _, err := fs.Stat(root, clean); err == nil {
+			fileServer.ServeHTTP(w, r)
+			return
+		} else if !errors.Is(err, fs.ErrNotExist) {
+			http.Error(w, "webui: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		// SPA fallback: serve index.html with a 200 so reloads on a
+		// client-side route don't 404.
+		r2 := r.Clone(r.Context())
+		r2.URL.Path = "/"
+		fileServer.ServeHTTP(w, r2)
+	})
+}
+
 func writeJSON(w http.ResponseWriter, status int, v any) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")