feat(build): embed web UI in backend binary + simplify Docker variants (#620)

- Add internal/webui/ package with //go:build embedui tag for optional
  SPA embedding (handler.go serves static files with SPA fallback)
- Add internal/version/ shared semver comparison (DRY: extracted from
  gateway/update_check.go and updater/updater.go)
- Enhance UpdateChecker: release notes, ETag caching, filter lite-v* tags
- Add web UI build stage to Dockerfile with ENABLE_EMBEDUI build arg
- Simplify CI: 7 Docker variants → 4 (base, latest, full, otel)
- Add SHA256 checksums job to release workflow
- Add Makefile build-full target (embeds web UI in Go binary)
- Default make up now embeds web UI (no separate nginx needed)
- Add WITH_WEB_NGINX=1 flag for optional nginx reverse proxy
- Update README + 30 translated READMEs: make up, port 18790
- Update docker-compose comments and prepare-env.sh
- About dialog: show release notes with markdown rendering
- Health card: amber badge for available updates

BREAKING: Default Docker setup no longer requires selfservice overlay.
Web dashboard served at :18790 (same port as API).

Dockerfile

@@ -1,6 +1,15 @@
 # syntax=docker/dockerfile:1
 
-# ── Stage 1: Build ──
+# ── Stage 0: Build Web UI (conditional) ──
+FROM node:22-alpine AS web-builder
+RUN corepack enable && corepack prepare pnpm@10.28.2 --activate
+WORKDIR /app
+COPY ui/web/package.json ui/web/pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+COPY ui/web/ .
+RUN pnpm build
+
+# ── Stage 1: Build Go ──
 FROM golang:1.26-bookworm AS builder
 
 WORKDIR /src
@@ -16,15 +25,22 @@ COPY . .
 ARG ENABLE_OTEL=false
 ARG ENABLE_TSNET=false
 ARG ENABLE_REDIS=false
+ARG ENABLE_EMBEDUI=false
 ARG VERSION=
 
+# Copy web UI dist for embedding (only used when ENABLE_EMBEDUI=true)
+COPY --from=web-builder /app/dist /src/internal/webui/dist
+
 # Build static binary (CGO disabled for scratch/alpine compatibility)
 # Version: build arg > VERSION file (auto-generated by Makefile) > "dev"
 RUN set -eux; \
     if [ -z "$VERSION" ] && [ -f VERSION ]; then VERSION=$(cat VERSION); fi; \
     if [ -z "$VERSION" ]; then VERSION="dev"; fi; \
     TAGS=""; \
-    if [ "$ENABLE_OTEL" = "true" ]; then TAGS="otel"; fi; \
+    if [ "$ENABLE_EMBEDUI" = "true" ]; then TAGS="embedui"; fi; \
+    if [ "$ENABLE_OTEL" = "true" ]; then \
+        if [ -n "$TAGS" ]; then TAGS="$TAGS,otel"; else TAGS="otel"; fi; \
+    fi; \
     if [ "$ENABLE_TSNET" = "true" ]; then \
         if [ -n "$TAGS" ]; then TAGS="$TAGS,tsnet"; else TAGS="tsnet"; fi; \
     fi; \