feat(server): runnable binary, Rune manifest, Docker image and CI

The HTTP server serves /healthz, the API namespace and the PWA, with the
frontend embedded behind a build tag so a clean checkout compiles without
a Node toolchain. /healthz reads the database rather than just answering:
a process that cannot reach its own data is not healthy, and a 200 there
would keep a broken container in rotation.

The image is distroless and static — the SQLite driver is pure Go, so
CGO stays off. The Rune manifest uses keep_entrypoint because there is
no shell in the image to run a startup command with, and its log watchers
match the JSON log format the container actually emits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/httpapi/context.go

@@ -0,0 +1,13 @@
+package httpapi
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+// contextWithTimeout bounds a single handler's work without outliving the request
+// itself: if the client has already gone away, the derived context is cancelled too.
+func contextWithTimeout(r *http.Request, d time.Duration) (context.Context, context.CancelFunc) {
+	return context.WithTimeout(r.Context(), d)
+}