[feat](web): serve the SPA and web actions on the single listener

Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/,
an embedded placeholder bundle, the /web/* auth and action handlers, and
the explicit browser-action allowlist. The SPA and the API share the one
plaintext :8080 listener; there is no second port and no peer edge, so
main.go also drops the mTLS listener and the identity mounts in the debug
compose fall away. /_manifest announces the web block only while the SPA is
mounted (honesty rule), always with the single service port.

The DSNs move to the shared database's scram-sha-256 credentials, matching
rev 9's removal of the PKI layer.

Committed web/bun.lock because web/package.json and vite.config.ts are new
in this commit. src/web/dist/index.html is a hand-written placeholder, not
a generated bundle: it keeps bare `go build`/`go vet` working from a clean
checkout, while /web/dist (the real build output) stays gitignored.

src/handlers/web/cookies.go

@@ -0,0 +1,62 @@
+// Copyright (C) 2026 Dcntrlized
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package web
+
+import (
+	"net/http"
+	"os"
+	"strconv"
+)
+
+const (
+	accessCookie  = "dcntrlized_access"
+	refreshCookie = "dcntrlized_refresh"
+	cookiePath    = "/web"
+)
+
+func cookieSecure() bool { return os.Getenv(EnvCookieSecure) == "true" }
+
+func maxAge(env string, def int) int {
+	if v := os.Getenv(env); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
+			return n
+		}
+	}
+	return def
+}
+
+func sessionCookie(name, value string, age int) *http.Cookie {
+	return &http.Cookie{
+		Name: name, Value: value, Path: cookiePath,
+		HttpOnly: true, SameSite: http.SameSiteLaxMode,
+		Secure: cookieSecure(), MaxAge: age,
+	}
+}
+
+func setSessionCookies(w http.ResponseWriter, access, refresh string) {
+	http.SetCookie(w, sessionCookie(accessCookie, access, maxAge(EnvAccessMaxAge, DefaultAccessMaxAge)))
+	http.SetCookie(w, sessionCookie(refreshCookie, refresh, maxAge(EnvRefreshMaxAge, DefaultRefreshMaxAge)))
+}
+
+func clearSessionCookies(w http.ResponseWriter) {
+	for _, name := range []string{accessCookie, refreshCookie} {
+		http.SetCookie(w, &http.Cookie{
+			Name: name, Value: "", Path: cookiePath,
+			HttpOnly: true, SameSite: http.SameSiteLaxMode,
+			Secure: cookieSecure(), MaxAge: -1,
+		})
+	}
+}