feat(server): runnable binary, Rune manifest, Docker image and CI

The HTTP server serves /healthz, the API namespace and the PWA, with the
frontend embedded behind a build tag so a clean checkout compiles without
a Node toolchain. /healthz reads the database rather than just answering:
a process that cannot reach its own data is not healthy, and a 200 there
would keep a broken container in rotation.

The image is distroless and static — the SQLite driver is pure Go, so
CGO stays off. The Rune manifest uses keep_entrypoint because there is
no shell in the image to run a startup command with, and its log watchers
match the JSON log format the container actually emits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -77,7 +77,7 @@ func TestMalformedHashNeverVerifies(t *testing.T) {
 		"$argon2id$v=19$m=0,t=0,p=0$c2FsdHNhbHRzYWx0$aGFzaA",     // zero parameters
 		"$argon2id$v=19$m=19456,t=2,p=1$!!!not-base64!!!$aGFzaA",
 		"$argon2id$v=19$m=19456,t=2,p=1$c2FsdHNhbHRzYWx0$", // empty digest
-		good[:len(good)-1],                                 // digest truncated by one character
+		good[:len(good)-1], // digest truncated by one character
 		good[:len(good)-8],
 	}
 	for _, h := range broken {