feat(deploy): add Dockerfile and vendor htmx for deployable image

Stage-0 web UI needs a self-contained container image. Two changes:

- Dockerfile: multi-stage build (golang:1.25 builder, CGO off + static
  link, -trimpath -s -w) into distroless static nonroot. The committed
  templ output and vendored asset mean a plain `go build` suffices — no
  codegen or CDN at build/run time. Existing .gitea CI already builds and
  pushes localhost:5000/tapir:<sha> + mirrors to GitHub (deploy patch
  intentionally omitted — cutover is held), so it only needed this file.

- Vendor htmx 1.9.12 locally (internal/web/static/, embed.FS, served at
  /static/ outside the auth guard) and point Layout at /static/htmx.min.js
  instead of unpkg. The deployed UI must not depend on an external CDN
  being reachable from the cluster.

task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1
+
+# ── build ───────────────────────────────────────────────────────────────────
+# templ output (*_templ.go) and the vendored htmx asset are committed, so a
+# plain `go build` produces a self-contained binary — no codegen, no CDN.
+FROM golang:1.25 AS build
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# CGO off + static linking so the binary runs in a distroless/scratch image with
+# no libc. Trim symbols/DWARF to shrink the layer.
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/tapir ./cmd/tapir
+
+# ── runtime ─────────────────────────────────────────────────────────────────
+# distroless static + nonroot: no shell, no package manager, runs as uid 65532.
+# ca-certificates are bundled, which the OIDC/HTTPS clients need.
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=build /out/tapir /tapir
+
+EXPOSE 8080
+USER nonroot:nonroot
+ENTRYPOINT ["/tapir"]
+CMD ["serve"]