feat(build): embed web UI in backend binary + simplify Docker variants (#620)

- Add internal/webui/ package with //go:build embedui tag for optional
  SPA embedding (handler.go serves static files with SPA fallback)
- Add internal/version/ shared semver comparison (DRY: extracted from
  gateway/update_check.go and updater/updater.go)
- Enhance UpdateChecker: release notes, ETag caching, filter lite-v* tags
- Add web UI build stage to Dockerfile with ENABLE_EMBEDUI build arg
- Simplify CI: 7 Docker variants → 4 (base, latest, full, otel)
- Add SHA256 checksums job to release workflow
- Add Makefile build-full target (embeds web UI in Go binary)
- Default make up now embeds web UI (no separate nginx needed)
- Add WITH_WEB_NGINX=1 flag for optional nginx reverse proxy
- Update README + 30 translated READMEs: make up, port 18790
- Update docker-compose comments and prepare-env.sh
- About dialog: show release notes with markdown rendering
- Health card: amber badge for available updates

BREAKING: Default Docker setup no longer requires selfservice overlay.
Web dashboard served at :18790 (same port as API).

internal/version/semver.go

@@ -0,0 +1,47 @@
+// Package version provides shared semantic version comparison utilities.
+package version
+
+import (
+	"strconv"
+	"strings"
+)
+
+// IsNewer returns true if version a is newer than b.
+// Both versions may include "v" prefix and pre-release suffixes (stripped before comparison).
+// Returns false if either version is "dev" or empty.
+func IsNewer(a, b string) bool {
+	a = strings.TrimPrefix(a, "v")
+	b = strings.TrimPrefix(b, "v")
+	if a == "dev" || a == "" || b == "dev" || b == "" {
+		return false
+	}
+	return Compare(a, b) > 0
+}
+
+// Compare compares two semver strings. Returns >0 if a > b, <0 if a < b, 0 if equal.
+// Strips "v" prefix and pre-release suffixes before comparison.
+func Compare(a, b string) int {
+	pa := Parse(a)
+	pb := Parse(b)
+	for i := range 3 {
+		if pa[i] != pb[i] {
+			return pa[i] - pb[i]
+		}
+	}
+	return 0
+}
+
+// Parse extracts [major, minor, patch] from a semver string.
+// Strips "v" prefix and pre-release suffixes (e.g. "v1.2.3-5-gabcdef" → [1, 2, 3]).
+func Parse(s string) [3]int {
+	s = strings.TrimPrefix(s, "v")
+	// Strip pre-release suffix: "1.2.3-rc1" → "1.2.3"
+	if idx := strings.IndexByte(s, '-'); idx >= 0 {
+		s = s[:idx]
+	}
+	var parts [3]int
+	for i, p := range strings.SplitN(s, ".", 3) {
+		parts[i], _ = strconv.Atoi(p)
+	}
+	return parts
+}