feat(build): embed web UI in backend binary + simplify Docker variants (#620)

- Add internal/webui/ package with //go:build embedui tag for optional
  SPA embedding (handler.go serves static files with SPA fallback)
- Add internal/version/ shared semver comparison (DRY: extracted from
  gateway/update_check.go and updater/updater.go)
- Enhance UpdateChecker: release notes, ETag caching, filter lite-v* tags
- Add web UI build stage to Dockerfile with ENABLE_EMBEDUI build arg
- Simplify CI: 7 Docker variants → 4 (base, latest, full, otel)
- Add SHA256 checksums job to release workflow
- Add Makefile build-full target (embeds web UI in Go binary)
- Default make up now embeds web UI (no separate nginx needed)
- Add WITH_WEB_NGINX=1 flag for optional nginx reverse proxy
- Update README + 30 translated READMEs: make up, port 18790
- Update docker-compose comments and prepare-env.sh
- About dialog: show release notes with markdown rendering
- Health card: amber badge for available updates

BREAKING: Default Docker setup no longer requires selfservice overlay.
Web dashboard served at :18790 (same port as API).

Makefile

@@ -2,21 +2,36 @@ VERSION ?= $(shell git describe --tags --abbrev=0 --match "v[0-9]*" 2>/dev/null
 LDFLAGS  = -s -w -X github.com/nextlevelbuilder/goclaw/cmd.Version=$(VERSION)
 BINARY   = goclaw
 
-.PHONY: build run clean version up down logs reset test vet check-web dev migrate setup ci desktop-dev desktop-build desktop-dmg
+.PHONY: build build-full run clean version up down logs reset test vet check-web dev migrate setup ci desktop-dev desktop-build desktop-dmg
 
+# Build backend only (API-only, no embedded web UI)
 build:
 	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o $(BINARY) .
 
+# Build with embedded web UI (recommended for production)
+build-full: check-web
+	rm -rf internal/webui/dist && mkdir -p internal/webui/dist
+	cp -r ui/web/dist/* internal/webui/dist/
+	CGO_ENABLED=0 go build -tags embedui -ldflags="$(LDFLAGS)" -o $(BINARY) .
+
 run: build
 	./$(BINARY)
 
 clean:
 	rm -f $(BINARY)
+	rm -rf internal/webui/dist
 
 version:
 	@echo $(VERSION)
 
-COMPOSE_BASE = docker compose -f docker-compose.yml -f docker-compose.postgres.yml -f docker-compose.selfservice.yml
+# ── Docker Compose ──
+# Default: backend (with embedded web UI) + Postgres. No separate nginx needed.
+# Add WITH_WEB_NGINX=1 for separate nginx on :3000 (custom SSL, reverse proxy).
+COMPOSE_BASE = docker compose -f docker-compose.yml -f docker-compose.postgres.yml
+ifdef WITH_WEB_NGINX
+COMPOSE_BASE += -f docker-compose.selfservice.yml
+export ENABLE_EMBEDUI=false
+endif
 COMPOSE_EXTRA =
 ifdef WITH_BROWSER
 COMPOSE_EXTRA += -f docker-compose.browser.yml
@@ -43,7 +58,7 @@ version-file:
 	@echo $(VERSION) > VERSION
 
 up: version-file
-	$(COMPOSE) up -d --build
+	GOCLAW_VERSION=$(VERSION) $(COMPOSE) up -d --build
 	$(UPGRADE) run --rm upgrade
 
 down: