Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

scripts/build.sh

@@ -39,6 +39,14 @@ if [ "$GIT_COMMIT" != "" ]; then
     LD_FLAGS="$LD_FLAGS -X git.avsdev.uk/Go/job-search/internal/version.GitCommit=${GIT_COMMIT}"
 fi
 
+# Build the frontend and copy it to internal/frontend/dist, where the binary
+# embeds it. npm ci installs exactly the lock file's versions: always for a
+# release, otherwise only when nothing is installed yet.
+if [[ $DO_RELEASE -eq 1 || ! -d web/node_modules ]]; then
+    (cd web && npm ci)
+fi
+(cd web && npm run build && npm run sync)
+
 # Process any generators
 go generate ./...