Phase 3: embed web UI with go:embed, pinned TypeScript toolchain, drop i18n, add /healthz

- html/embed.go embeds html/ (pages, css, img, js, video); src/assets.go
  serves it, with os.DirFS("html") under -dev. Static assets get an ETag
  and Cache-Control: no-cache; HTML pages are still templated (only the
  login error message is substituted now).
- Delete the generated src/webUI.go (783 KB base64), src/html-build.go and
  cmd/webui-gen; Dockerfile no longer runs a generator.
- Language layer removed: 254 {{.x}} placeholders inlined as English
  strings in ts/*.ts and the two auth pages; html/lang/en.json, the
  LanguageUI struct and the 'language' setting are gone.
- ts/tsconfig.json + package.json pin typescript 5.9.3; the seven sources
  compile (ES2020, global scripts) into one committed html/js/app.js.
  Ten unreferenced legacy scripts under html/js/ deleted; all pages load
  js/app.js.
- Fix the six type errors that blocked a clean compile, including a real
  bug: a missing semicolon in the search shortcut handler made the code
  call the result of preventDefault(), so the shortcut threw instead of
  focusing the search box.
- /healthz liveness endpoint; Dockerfile healthcheck and README use it.
- Drone: go vet, and a webui-check step that rebuilds the bundle and fails
  if the committed app.js is stale.
- README-DEV.md documents build, UI toolchain, -dev, versioning, CI.

tasks/todo.md

@@ -43,14 +43,14 @@ Status: Phase 0 committed on branch `improvements` 2026-09-26.
 - [ ] Error hygiene: no-op closures, `os.Exit`/`panic` outside main, ignored results
 
 ## Phase 3: Build, embed, CI, Docker
-- [ ] `//go:embed html`, delete `webUI.go`, `html-build.go`, `cmd/webui-gen`; cache headers
-- [ ] Drop i18n: inline English strings into TS, delete `en.json`, template only HTML pages
-- [ ] `package.json` + `tsconfig.json` + esbuild bundle (committed, CI-verified); delete 10 dead JS files
-- [ ] CI: vet, lint, gofmt, `test -race`, `tsc --noEmit`, generated-output check
+- [x] `//go:embed` via `html/embed.go`; deleted `webUI.go`, `html-build.go`, `cmd/webui-gen`; ETag + Cache-Control on static assets
+- [x] i18n dropped: 254 placeholders inlined, `en.json` deleted, only HTML pages templated (`authenticationErr`)
+- [x] `package.json` + `ts/tsconfig.json` (tsc 5.9.3, ES2020, single outFile `html/js/app.js`, committed, CI-verified); 10 dead JS files deleted; 6 tsc errors fixed incl. a real ASI bug in the search shortcut
+- [ ] CI: vet (done), lint, gofmt, `test -race`; bundle freshness check (done)
 - [ ] Version-tagged images (amd64 only)
 - [ ] PUID/PGID via su-exec; pin static-ffmpeg; `VOLUME`; fix `LEGACY_CONFIG_DIRS`
-- [ ] `/healthz` endpoint
-- [ ] `README-DEV.md` and fork section in `README.md`
+- [x] `/healthz` endpoint; Dockerfile healthcheck uses it
+- [ ] `README-DEV.md` (done) and fork section in `README.md`
 - [ ] Deduplicate and delete dead code; drop `ioutil`, `osext`, `rand.Seed` (after go:embed)
 - [ ] Resolve missing `docs/design-system/` referenced by `agent.md`