[feat](web): serve the SPA and web actions on the single listener

Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/,
an embedded placeholder bundle, the /web/* auth and action handlers, and
the explicit browser-action allowlist. The SPA and the API share the one
plaintext :8080 listener; there is no second port and no peer edge, so
main.go also drops the mTLS listener and the identity mounts in the debug
compose fall away. /_manifest announces the web block only while the SPA is
mounted (honesty rule), always with the single service port.

The DSNs move to the shared database's scram-sha-256 credentials, matching
rev 9's removal of the PKI layer.

Committed web/bun.lock because web/package.json and vite.config.ts are new
in this commit. src/web/dist/index.html is a hand-written placeholder, not
a generated bundle: it keeps bare `go build`/`go vet` working from a clean
checkout, while /web/dist (the real build output) stays gitignored.

Dockerfile

@@ -1,3 +1,13 @@
+# --- Web build stage (browser-edge SPA, contract §10.2) ---
+# Produces /web/dist, copied into the Go build context as web/dist so the
+# //go:embed all:web/dist directive in src/web_assets.go picks it up.
+FROM oven/bun:1.3.9-alpine AS web-builder
+WORKDIR /web
+COPY web/package.json web/bun.lock ./
+RUN bun ci
+COPY web/ ./
+RUN bun run build
+
 # --- Build Stage ---
 FROM golang:1.26 AS builder
 WORKDIR /app
@@ -13,8 +23,11 @@ COPY src/go.mod src/go.sum ./
 RUN go mod download
 
 COPY src/ ./
+COPY --from=web-builder /web/dist ./web/dist
 
-RUN CGO_ENABLED=0 GOOS=linux go build -o server main.go
+# Build the whole main package (not just main.go): the browser-edge SPA embed
+# lives in web_assets.go, so a single-file build would not see embeddedWeb.
+RUN CGO_ENABLED=0 GOOS=linux go build -o server .
 
 # --- Run Stage ---
 FROM alpine:latest
@@ -30,4 +43,8 @@ LABEL org.opencontainers.image.revision=$IMAGE_REVISION
 
 COPY --from=builder /app/server .
 
+# Contract rev 9 §3.3: exactly ONE plaintext listener (:8080) serves the API
+# and the embedded browser web app (SPA + /web/*). No second port, no PKI.
+EXPOSE 8080
+
 CMD ./server