feat: embed web UI in server binary + local trigger-scan write endpoint

Server becomes self-contained: web/dist embedded via go:embed
(server/internal/webui), SPA served from the binary with JSON-404 guard on
/api paths, nginx web container removed from compose (31336 now maps to the
server). Clean checkouts without the UI copy build API-only.

Agent local API gains its first write endpoint, POST /v1/actions/trigger-scan
(FEAT-002 write path): group-ACL authorized, single-flight, 202/409/503
semantics. Registered agents run the same HandleScanUpdates path as a signed
scan command (empty command_id, no ack tracking); standalone agents scan
through the orchestrator into the local read model only. Also repairs
localapi tests left uncompilable by the desktop-provider parameter.

README.md

@@ -110,15 +110,10 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 ## Architecture
 
 ```
-┌─────────────────┐
-│  Web Dashboard  │  React + TypeScript
-│  Port: 31336    │
-└────────┬────────┘
-         │ HTTPS + JWT + Machine Binding
-┌────────▼────────┐
-│  Server (Go)    │  PostgreSQL · Ed25519 Signing Service
-│  Port: 31337    │
-└────────┬────────┘
+┌─────────────────────────────┐
+│  Server (Go)                │  PostgreSQL · Ed25519 Signing Service
+│  Embedded React dashboard   │  Dashboard: 31336 · Agent API: 31337
+└────────┬────────────────────┘
          │ Pull-based (agents check in, not the reverse)
          ├──────────────────┐
 ┌────────▼────────┐  ┌──────▼──────────┐