Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

internal/frontend/embed.go

@@ -0,0 +1,24 @@
+package frontend
+
+import (
+	"embed"
+	"io/fs"
+)
+
+// dist holds the frontend's build output, copied from web/dist by `npm run
+// sync` in web/. Only dist/.gitkeep is committed (Go can't embed a missing
+// directory), so a binary built without syncing first has no frontend.
+//
+//go:embed all:dist
+var dist embed.FS
+
+// Embedded returns the frontend's build output embedded in the binary, or
+// nil if none was synced before it was built (there is no index.html).
+func Embedded() fs.FS {
+	files, err := fs.Sub(dist, "dist")
+	if err != nil || CheckFS(files) != nil {
+		return nil
+	}
+
+	return files
+}