Rebuild the admin dashboard as a Svelte 5 + TypeScript app

Frontend in web/ (Vite via bun, pure CSS, no component libraries),
built to internal/dashboard/dist and embedded into the binary; the
Dockerfile builds it in a bun stage. Old static dashboard.html removed.

AGENTS.md

@@ -30,9 +30,15 @@ what we take vs. skip). Never vendor it into the build.
   checked before auth (404 before 401), body JSON syntax before everything
 - `internal/server/bridge.go` — WebSocket bridge sessions: attach, route
   claiming (one owner per route), heartbeats, idle retirement, visitor pumps
-- `internal/server/admin.go` + `dashboard.html` — the admin dashboard served
-  at `/` (embedded HTML, no build step) and `GET /api/admin/overview`, both
-  behind the `ADMIN_TOKEN` bearer token (503 when unset, 401 when wrong)
+- `internal/server/admin.go` — the admin dashboard handlers: `GET
+  /api/admin/overview` (bearer `ADMIN_TOKEN`, 503 when unset, 401 when
+  wrong) and the page/assets served from the embedded frontend
+- `web/` — the dashboard frontend: Svelte 5 (runes) + TypeScript, Vite via
+  bun, pure CSS, no component libraries. `bun run build` emits to
+  `internal/dashboard/dist` (gitignored; the committed `.gitkeep` keeps
+  `go:embed all:dist` valid, and the handler answers 503 until built).
+  `internal/dashboard` embeds the output; the Dockerfile builds it in a bun
+  stage before the Go build
 - `internal/server/relay.go` — public TLS listener: parses the ClientHello,
   terminates the domain itself, passes tunnel hostnames to bridges untouched
 
@@ -40,6 +46,9 @@ what we take vs. skip). Never vendor it into the build.
 
 - `go build ./...` / `go vet ./...` / `gofmt -l .` — must stay clean
 - `go test ./...`
+- Frontend: `cd web && bun install && bun run check && bun run build` — the
+  dashboard test skips when `internal/dashboard/dist` has no build (only the
+  committed `.gitkeep`)
 - Dev loop: `go build -o .local/tunneld ./cmd/tunneld && .local/tunneld -domain localhost`,
   then `OPENTUNNEL_API=http://localhost:8080 opentunnel route add 4096 --name api`
   with the official CLI. `go build` drops a binary next to the source — it is