Rebuild the admin dashboard as a Svelte 5 + TypeScript app

Frontend in web/ (Vite via bun, pure CSS, no component libraries),
built to internal/dashboard/dist and embedded into the binary; the
Dockerfile builds it in a bun stage. Old static dashboard.html removed.

internal/server/admin.go

@@ -2,16 +2,15 @@ package server
 
 import (
 	"crypto/subtle"
-	_ "embed"
+	"io/fs"
 	"net/http"
 	"runtime"
 	"sort"
 	"strings"
 	"time"
-)
 
-//go:embed dashboard.html
-var dashboardHTML []byte
+	"gitea.tzgyn.dev/TZGyn/tunnel/internal/dashboard"
+)
 
 // ---- admin API: GET /api/admin/overview, bearer ADMIN_TOKEN.
 
@@ -153,9 +152,21 @@ func (a *API) caExpiry() string {
 	return expiryString(ca.cert.NotAfter)
 }
 
-// dashboard serves the admin page; data comes from /api/admin/overview.
+// dashboard serves the built Svelte admin page and its assets; data comes
+// from /api/admin/overview. Without a built frontend (only the .gitkeep
+// placeholder), it answers 503 with the build command.
 func (a *API) dashboard(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Header().Set("X-Robots-Tag", "noindex")
-	w.Write(dashboardHTML)
+	dist := dashboard.FS()
+	if r.URL.Path == "/" || r.URL.Path == "/admin" {
+		page, err := fs.ReadFile(dist, "index.html")
+		if err != nil {
+			http.Error(w, "dashboard not built: run `bun install && bun run build` in web/", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Header().Set("X-Robots-Tag", "noindex")
+		w.Write(page)
+		return
+	}
+	http.FileServer(http.FS(dist)).ServeHTTP(w, r)
 }