Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

.gitignore

@@ -38,4 +38,9 @@ build/
 # Release directory
 release/
 
-mock-data/
+mock-data/
+
+# The frontend's build output, copied by npm run sync in web/ for embedding.
+# .gitkeep is kept, as Go can't embed a missing directory.
+internal/frontend/dist/*
+!internal/frontend/dist/.gitkeep