feat: Web frontend console with one-click checkin and scan-login

[Lwn666]

Summary

Add an embedded web frontend console: account overview, one-click checkin, and scan-to-login.

This is a purely additive feature — it does NOT modify any existing upstream handler logic. The web UI reads account data from the existing GET /status endpoint, and local API routes are mounted via a wrapping middleware.

What is included

File	Purpose
internal/server/web/	Static SPA (account cards, checkin button, scan-login) — embedded via go:embed
internal/server/web_extra.go	WrapWeb middleware: routes /, /web/* to frontend, /api/checkin + /api/login/* to LocalAPI, everything else passes through to upstream handler
internal/server/local_api.go	LocalAPI struct: POST /api/checkin (triggers scheduler checkin round), POST /api/login/start + GET /api/login/poll (OAuth device flow)
internal/login/login.go	OAuth device-flow library — same flow as cmd/login but importable from the server (the CLI is package main, not importable)
cmd/server/main.go	Mount the web UI: var handler http.Handler = h; if os.Getenv("WEB_DISABLED") != "1" { ... WrapWeb(...) }
Dockerfile	Bug fix: COPY config.example.json /app/config.json instead of COPY config.json (which is gitignored and does not exist in the repo — a fresh clone would fail to build)

Design notes

• Zero conflict: no changes to internal/server/handler.go, pool, scheduler or upstream. WrapWeb is a wrapping middleware, LocalAPI is a separate struct.
• Feature flags: WEB_DISABLED=1 disables the whole UI; LOGIN_DISABLED=1 disables just the scan-login API.
• Dependencies: all APIs used (writeJSON, writeOpenAIError, Pool.Add/SetCredits/Disable, Scheduler.RunCheckinNow, Upstream.UserResource, auth.Auth) already exist in upstream.
• No config change: uses only env vars + existing cfg.AuthDir.

Test

• go build ./... ✓
• go test ./... ✓
• docker build ✓ (CI on the fork passes)

Screenshot

Account overview shows stat cards (accounts/healthy/disabled/credits) + per-account cards with nickname, UID, credits, status badge, one-click refresh and checkin.