feat(build): embed web UI in backend binary + simplify Docker variants (#620)

- Add internal/webui/ package with //go:build embedui tag for optional
  SPA embedding (handler.go serves static files with SPA fallback)
- Add internal/version/ shared semver comparison (DRY: extracted from
  gateway/update_check.go and updater/updater.go)
- Enhance UpdateChecker: release notes, ETag caching, filter lite-v* tags
- Add web UI build stage to Dockerfile with ENABLE_EMBEDUI build arg
- Simplify CI: 7 Docker variants → 4 (base, latest, full, otel)
- Add SHA256 checksums job to release workflow
- Add Makefile build-full target (embeds web UI in Go binary)
- Default make up now embeds web UI (no separate nginx needed)
- Add WITH_WEB_NGINX=1 flag for optional nginx reverse proxy
- Update README + 30 translated READMEs: make up, port 18790
- Update docker-compose comments and prepare-env.sh
- About dialog: show release notes with markdown rendering
- Health card: amber badge for available updates

BREAKING: Default Docker setup no longer requires selfservice overlay.
Web dashboard served at :18790 (same port as API).

README.md

@@ -185,8 +185,11 @@ chmod +x prepare-env.sh && ./prepare-env.sh
 # Add at least one GOCLAW_*_API_KEY to .env, then:
 make up
 
-# Web Dashboard at http://localhost:3000
+# Web Dashboard at http://localhost:18790 (built-in)
 # Health check: curl http://localhost:18790/health
+
+# Optional: separate nginx for custom SSL/reverse proxy
+# make up WITH_WEB_NGINX=1  → Dashboard at http://localhost:3000
 ```
 
 `make up` creates a Docker network, embeds the correct version from git tags, builds and starts all services, and runs database migrations automatically.
@@ -222,9 +225,32 @@ make down WITH_BROWSER=1 WITH_OTEL=1
 
 When `GOCLAW_*_API_KEY` environment variables are set, the gateway auto-onboards without interactive prompts — detects provider, runs migrations, and seeds default data.
 
-> `ghcr.io/nextlevelbuilder/goclaw:latest` is the minimal runtime image and does **not** include Python or Node.js by default. If you need those runtimes preinstalled, use the `python`, `node`, or `full` image variant, run `./scripts/setup-docker.sh --variant <python|node|full>`, or rebuild locally with `ENABLE_PYTHON=true`, `ENABLE_NODE=true`, or `ENABLE_FULL_SKILLS=true`.
+> **Docker image variants:**
+> | Image | Description |
+> |-------|-------------|
+> | `latest` | Backend + embedded web UI + Python (**recommended**) |
+> | `latest-base` | Backend API-only, no web UI, no runtimes |
+> | `latest-full` | All runtimes + skill dependencies pre-installed |
+> | `latest-otel` | Latest + OpenTelemetry tracing |
+> | `goclaw-web` | Standalone nginx + React SPA (for custom reverse proxy) |
+>
+> For custom builds (Tailscale, Redis): `docker build --build-arg ENABLE_TSNET=true ...`
+> See the [Deployment Guide](https://docs.goclaw.sh/#deploy-docker-compose) for details.
 
-> For build variants (OTel, Tailscale, Redis), Docker image tags, and compose overlays, see the [Deployment Guide](https://docs.goclaw.sh/#deploy-docker-compose).
+## Updating
+
+### Docker
+```bash
+docker compose pull && docker compose up -d
+```
+
+### Binary (with embedded web UI)
+```bash
+goclaw update --apply    # Downloads, verifies SHA256, swaps binary, restarts
+```
+
+### Web Dashboard
+Open **About** dialog → click **Update Now** (admin only). The update includes both backend and web dashboard when using the default `latest` image.
 
 ## Multi-Agent Orchestration