Phase 3: embed web UI with go:embed, pinned TypeScript toolchain, drop i18n, add /healthz

- html/embed.go embeds html/ (pages, css, img, js, video); src/assets.go
  serves it, with os.DirFS("html") under -dev. Static assets get an ETag
  and Cache-Control: no-cache; HTML pages are still templated (only the
  login error message is substituted now).
- Delete the generated src/webUI.go (783 KB base64), src/html-build.go and
  cmd/webui-gen; Dockerfile no longer runs a generator.
- Language layer removed: 254 {{.x}} placeholders inlined as English
  strings in ts/*.ts and the two auth pages; html/lang/en.json, the
  LanguageUI struct and the 'language' setting are gone.
- ts/tsconfig.json + package.json pin typescript 5.9.3; the seven sources
  compile (ES2020, global scripts) into one committed html/js/app.js.
  Ten unreferenced legacy scripts under html/js/ deleted; all pages load
  js/app.js.
- Fix the six type errors that blocked a clean compile, including a real
  bug: a missing semicolon in the search shortcut handler made the code
  call the result of preventDefault(), so the shortcut threw instead of
  focusing the search box.
- /healthz liveness endpoint; Dockerfile healthcheck and README use it.
- Drone: go vet, and a webui-check step that rebuilds the bundle and fails
  if the committed app.js is stale.
- README-DEV.md documents build, UI toolchain, -dev, versioning, CI.

.drone.yml

@@ -7,8 +7,17 @@ steps:
     image: cache.coadcorp.com/library/golang:1.27.1
     commands:
       - go mod download
+      - go vet ./...
       - go test ./...
 
+  - name: webui-check
+    image: cache.coadcorp.com/library/node:22-alpine
+    commands:
+      - cp html/js/app.js /tmp/app.js.committed
+      - npm ci --no-audit --no-fund
+      - npm run build
+      - cmp /tmp/app.js.committed html/js/app.js || (echo "html/js/app.js is stale - run 'npm run build' and commit the result" && exit 1)
+
   - name: go-build
     image: cache.coadcorp.com/library/golang:1.27.1
     commands: