[feat](web): serve the SPA and web actions on the single listener

Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/,
an embedded placeholder bundle, the /web/* auth and action handlers, and
the explicit browser-action allowlist. The SPA and the API share the one
plaintext :8080 listener; there is no second port and no peer edge, so
main.go also drops the mTLS listener and the identity mounts in the debug
compose fall away. /_manifest announces the web block only while the SPA is
mounted (honesty rule), always with the single service port.

The DSNs move to the shared database's scram-sha-256 credentials, matching
rev 9's removal of the PKI layer.

Committed web/bun.lock because web/package.json and vite.config.ts are new
in this commit. src/web/dist/index.html is a hand-written placeholder, not
a generated bundle: it keeps bare `go build`/`go vet` working from a clean
checkout, while /web/dist (the real build output) stays gitignored.

docker-compose.yaml

@@ -9,9 +9,17 @@ services:
     ports:
       - "8081:8080"
       - "9090:90"
+    # Contract rev 9 §3.4: ONE plaintext listener, published as 8081:8080. The
+    # browser web app (SPA + /web/*) rides the same port — there is no separate
+    # browser port. Opt-in in prod via DCNTRLIZED_WEB_ENABLED=true;
+    # web.Validate() then fails closed unless DCNTRLIZED_WEB_ORIGINS is
+    # non-empty and COOKIE_SECURE=true.
     environment:
-      - DATABASE_URL=postgres://postgres:@dcntrlized-db:5432/dcntrlized
+      - DATABASE_URL=postgres://postgres:dcntrlized@dcntrlized-db:5432/dcntrlized?sslmode=disable
       - AUTH_SERVICE_URL=http://dcntrlized-auth:8080
+      - DCNTRLIZED_WEB_ENABLED=${DCNTRLIZED_WEB_ENABLED:-false}
+      - DCNTRLIZED_WEB_ORIGINS=${DCNTRLIZED_WEB_ORIGINS:-}
+      - COOKIE_SECURE=${COOKIE_SECURE:-true}
     depends_on:
       - migrate
     build:
@@ -31,7 +39,7 @@ services:
       - PGHOST=dcntrlized-db
       - PGPORT=5432
       - PGUSER=postgres
-      - PGPASSWORD=
+      - PGPASSWORD=dcntrlized
       - PGDATABASE=dcntrlized
     command: >
       sh -c 'until pg_isready -h dcntrlized-db; do sleep 2; done;