Phase 4: embed UI into kamado-api binary

The production image is now a single Go binary that serves both the
JSON/WebSocket API under /api and the Svelte dashboard at /.

- New internal/webui package embeds a dist/ subdir via //go:embed.
  A placeholder index.html is committed so `go build` works on a
  fresh checkout; anything else in dist/ is regenerated per build
  and gitignored.

- httpapi.Server.Handler mounts the embed.FS at / with SPA-style
  fallback: unknown non-/api paths serve index.html so client-side
  routes survive a reload. /api/* is carved out explicitly so POSTs
  or typos never accidentally shadow API semantics with HTML.

- api/Dockerfile grows a node:22 builder stage that runs
  `npm ci && npm run build`, and the Go stage copies ui/dist/ into
  internal/webui/dist/ before `go build`. Build context moves to
  the repo root (docker-compose + `make api` both updated) so the
  Dockerfile can see both api/ and ui/.

With this in place, `make up` brings the whole stack online at
http://localhost:8080 — API under /api, dashboard at /. The Vite
dev server on :5173 with the /api proxy is still available via
`make ui-dev` for hot-reload development.

api/internal/webui/embed.go

@@ -0,0 +1,39 @@
+// Package webui embeds the built Svelte dashboard into the kamado-api
+// binary so the production image is a single Go binary plus ckpool.
+//
+// The `dist/` subdirectory is populated at build time:
+//
+//   - `make api` (local) runs `make ui` first and copies ui/dist/*
+//     into api/internal/webui/dist/ before `go build`.
+//   - The api Dockerfile has a node builder stage that does the same
+//     inside the image build.
+//
+// A placeholder index.html is committed so `go build` succeeds on a
+// fresh checkout without anyone having run `make ui` — it just shows
+// a "UI not built" notice instead of the real dashboard.
+package webui
+
+import (
+	"embed"
+	"io/fs"
+)
+
+// `//go:embed dist` (without `all:`) skips dot-prefixed files, which
+// means the .gitignore we use to untrack build artifacts in this
+// directory doesn't end up baked into the binary.
+//
+//go:embed dist
+var distFS embed.FS
+
+// FS returns the embedded dist directory as a sub-filesystem so
+// callers can pass it directly to http.FileServerFS.
+func FS() fs.FS {
+	sub, err := fs.Sub(distFS, "dist")
+	if err != nil {
+		// Only possible if the "dist" directory literally does not
+		// exist in the embed, which is a build-time error we'd see
+		// before the binary ran.
+		panic("webui: embedded dist missing: " + err.Error())
+	}
+	return sub
+}