Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

web/README.md

@@ -14,6 +14,10 @@ default address (`http://localhost:9393`). To use another, copy `.env.example`
 to `.env` and set `API_PROXY_TARGET`. `VITE_API_BASE_URL` changes the `/api`
 prefix for production builds.
 
+`npm run build` type-checks and builds the app into `dist/`. `npm run sync`
+then copies `dist/` to `../internal/frontend/dist/`, where the backend embeds
+it: the next Go build of `job-search` serves it. The copy isn't committed.
+
 Before committing, `npm run check` type-checks, lints (ESLint) and checks
 formatting (Prettier); `npm run format` formats everything. See
 [CODE_CONVENTIONS.md](CODE_CONVENTIONS.md).