Phase 3: embed web UI with go:embed, pinned TypeScript toolchain, drop i18n, add /healthz

- html/embed.go embeds html/ (pages, css, img, js, video); src/assets.go
  serves it, with os.DirFS("html") under -dev. Static assets get an ETag
  and Cache-Control: no-cache; HTML pages are still templated (only the
  login error message is substituted now).
- Delete the generated src/webUI.go (783 KB base64), src/html-build.go and
  cmd/webui-gen; Dockerfile no longer runs a generator.
- Language layer removed: 254 {{.x}} placeholders inlined as English
  strings in ts/*.ts and the two auth pages; html/lang/en.json, the
  LanguageUI struct and the 'language' setting are gone.
- ts/tsconfig.json + package.json pin typescript 5.9.3; the seven sources
  compile (ES2020, global scripts) into one committed html/js/app.js.
  Ten unreferenced legacy scripts under html/js/ deleted; all pages load
  js/app.js.
- Fix the six type errors that blocked a clean compile, including a real
  bug: a missing semicolon in the search shortcut handler made the code
  call the result of preventDefault(), so the shortcut threw instead of
  focusing the search box.
- /healthz liveness endpoint; Dockerfile healthcheck and README use it.
- Drone: go vet, and a webui-check step that rebuilds the bundle and fails
  if the committed app.js is stale.
- README-DEV.md documents build, UI toolchain, -dev, versioning, CI.

README-DEV.md

@@ -1 +1,57 @@
-# Information for the developers will come soon
+# Developer notes
+
+## Layout
+
+| Path | What it is |
+|---|---|
+| `xteve.go` | `main`: flags, version, start-up |
+| `src/` | the application (one Go package `src`) |
+| `src/internal/` | authentication, image cache, M3U parser |
+| `html/` | web interface: HTML pages, CSS, images, the compiled `js/app.js`, and `embed.go` which embeds the lot |
+| `ts/` | TypeScript sources for the web interface |
+| `docker/` | container entrypoint |
+| `tasks/` | improvement plan and checklist |
+
+## Build the binary
+
+Go 1.27.1 is pinned in `go.mod`; the go command downloads it automatically.
+
+```bash
+go build ./...
+go vet ./...
+go test ./...
+```
+
+The web interface is embedded with `go:embed` from `html/`, so a bare clone builds a complete binary.
+
+## Web interface
+
+The UI is plain TypeScript compiled as global scripts (no modules yet) into a single bundle, `html/js/app.js`, which is committed. CI rebuilds it and fails if the committed file is stale.
+
+```bash
+npm ci          # installs the pinned TypeScript compiler
+npm run build   # ts/*.ts -> html/js/app.js
+npm run check   # type-check only
+```
+
+File order in the bundle is fixed in `ts/tsconfig.json` and matches the old per-page script order. All pages load the same bundle.
+
+English strings are inlined in the TypeScript. There is no language layer.
+
+## Run from source
+
+```bash
+go run . -config /path/to/config -port 34400
+```
+
+Add `-dev` to serve the web interface from the local `html/` directory instead of the embedded copy, so CSS and HTML edits show up on reload. JavaScript still needs `npm run build`.
+
+## Versioning and release
+
+The version lives in two places that must agree: `var Version` in `xteve.go` and the first `#### ` heading in `changelog-beta.md` (without the `-beta` suffix). CI fails on drift.
+
+Drone (`.drone.yml`) runs vet, tests, the bundle check, hadolint and compose validation on every push. Pushes to `master` publish `registry.coadcorp.com/nathan/xteve:latest` and `:<sha>`; other branches publish `:<branch>` and `:<sha>`.
+
+## Endpoints useful for operations
+
+* `GET /healthz` returns `{"status":"ok","version":...,"scanInProgress":...}` with no authentication. The Docker healthcheck uses it.