feat(maestro): build web bundle into Docker image

NAP-218. Add a node:20 stage to the registry Dockerfile that runs
`pnpm install && pnpm build` against `web/`, then copies the
resulting `dist/` into the Rust builder so rust-embed picks it up.
Single-binary deploy still — no separate static-asset volume.

`.dockerignore` keeps `web/node_modules` and `web/dist` out of the
build context (the node stage produces them fresh) while letting the
sources through.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -4,6 +4,7 @@ worktrees/
 .github/
 .claude/
 docs/
-web/
+web/node_modules/
+web/dist/
 *.md
 .env*

Dockerfile

@@ -9,9 +9,22 @@
 # set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
 # No persistent volume is required when MAESTRO_TOKEN is provided.
 
+# 1. Build the web client bundle. Output lands in /web/dist and is consumed
+#    by the Rust builder below via `rust-embed`.
+FROM node:20-bookworm AS web-builder
+WORKDIR /web
+RUN corepack enable
+COPY web/package.json web/pnpm-lock.yaml* ./
+RUN pnpm install --frozen-lockfile || pnpm install
+COPY web/ ./
+RUN pnpm build
+
+# 2. Build the registry binary. `rust-embed` picks up the bundle that the
+#    previous stage produced.
 FROM rust:1-bookworm AS builder
 WORKDIR /build
 COPY . .
+COPY --from=web-builder /web/dist /build/web/dist
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/build/target \
     cargo build --release -p maestro-registry \

crates/maestro-registry/src/web_assets.rs

@@ -17,8 +17,7 @@ use rust_embed::RustEmbed;
 #[folder = "../../web/dist/"]
 struct WebAssets;
 
-const FALLBACK_INDEX: &str =
+const FALLBACK_INDEX: &str = "<!doctype html><meta charset=utf-8><title>maestro</title>\
-    "<!doctype html><meta charset=utf-8><title>maestro</title>\
      <h1>maestro registry</h1>\
      <p>Web bundle not built. Run <code>pnpm --dir web install</code> \
      then <code>pnpm --dir web build</code>, then rebuild the registry.</p>";