feat(server): runnable binary, Rune manifest, Docker image and CI

The HTTP server serves /healthz, the API namespace and the PWA, with the
frontend embedded behind a build tag so a clean checkout compiles without
a Node toolchain. /healthz reads the database rather than just answering:
a process that cannot reach its own data is not healthy, and a 200 there
would keep a broken container in rotation.

The image is distroless and static — the SQLite driver is pure Go, so
CGO stays off. The Rune manifest uses keep_entrypoint because there is
no shell in the image to run a startup command with, and its log watchers
match the JSON log format the container actually emits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/verdande/web_embed.go

@@ -0,0 +1,16 @@
+//go:build embedweb
+
+package main
+
+import (
+	"embed"
+	"io/fs"
+)
+
+// The built SvelteKit app. Present only in a release build, which runs the frontend
+// build first and then compiles with `-tags embedweb`.
+//
+//go:embed all:webbuild
+var webFS embed.FS
+
+func embeddedWeb() (fs.FS, error) { return fs.Sub(webFS, "webbuild") }