Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

internal/config/conf_server_frontend.go

@@ -9,7 +9,7 @@ const JSCKServerFrontend string = "frontend"
 
 // JSCServerFrontend configures how the server serves the frontend. Dir is
 // the directory of the frontend's build output (holding index.html); empty
-// means no frontend is served, as there is no embedded build yet.
+// means the build embedded in the binary, or no frontend if it has none.
 // ImmutablePrefix is where Vite emits content-hashed files, cached for a
 // year; empty means "/assets/". IndexCacheControl is the Cache-Control of
 // HTML and other files without a hash; empty means "no-cache".