feat(server): runnable binary, Rune manifest, Docker image and CI

The HTTP server serves /healthz, the API namespace and the PWA, with the
frontend embedded behind a build tag so a clean checkout compiles without
a Node toolchain. /healthz reads the database rather than just answering:
a process that cannot reach its own data is not healthy, and a 200 there
would keep a broken container in rotation.

The image is distroless and static — the SQLite driver is pure Go, so
CGO stays off. The Rune manifest uses keep_entrypoint because there is
no shell in the image to run a startup command with, and its log watchers
match the JSON log format the container actually emits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -23,3 +23,6 @@ node_modules/
 *.swp
 .idea/
 .vscode/
+
+# Copied in by the Docker build; never committed.
+/cmd/verdande/webbuild/