Embedded the frontend in the binary, and built it in the build script

`npm run sync` in web/ copies the build output (web/dist, from npm run build)
to internal/frontend/dist, which the binary embeds. Go can't embed from
outside the package's directory (web/ is also outside the Go module), hence
the copy. Only dist/.gitkeep is committed, so a fresh clone still compiles,
and a binary built without syncing first serves no frontend.

job-search serve serves server.frontend.dir if it is set, or else the
embedded build, or warns that there is no frontend. scripts/build.sh builds
and syncs the frontend before building, running npm ci first for a release
or when web/node_modules is missing.

web/scripts/syncDist.ts

@@ -0,0 +1,24 @@
+// Copies the frontend's build output, dist/ (from npm run build), to
+// ../internal/frontend/dist/, which the backend embeds, so the next Go build
+// of job-search serves this frontend:
+//
+//   npm run build && npm run sync
+//
+// The old copy is replaced entirely, so files from an earlier build don't
+// linger. Its .gitkeep, the only file there that's committed, is put back:
+// Go can't embed a directory that doesn't exist.
+import { cpSync, existsSync, rmSync, writeFileSync } from 'node:fs';
+
+const source = 'dist';
+const target = '../internal/frontend/dist';
+
+if (!existsSync(`${source}/index.html`)) {
+  console.error(`${source}/index.html not found: run npm run build first`);
+  process.exit(1);
+}
+
+rmSync(target, { recursive: true, force: true });
+cpSync(source, target, { recursive: true });
+writeFileSync(`${target}/.gitkeep`, '');
+
+console.log(`Copied ${source}/ to ${target}/`);