feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/doc.go

@@ -0,0 +1,18 @@
+// Package webapp implements the local web UI for the distributed
+// monitoring worker. See docs/distributed/worker-web-app.md.
+//
+// Phase 1 (MVP) implements:
+//
+//   - Local-only auth (section 5.3): first-run password printed to
+//     the worker log, bcrypt-hashed in the local SQLite store, forced
+//     change on first login, session cookie with HTTP-only/Secure
+//     (loopback-aware)/SameSite=Strict.
+//   - Pages: overview, discovered apps (read-only), checks
+//     (read-only), notifications (read-only), logs (worker log only),
+//     settings (worker fields), updates.
+//   - Server status: /proc and sysfs only (no SMART, no docker).
+//   - Audit log with 7-day retention.
+//
+// Phase 2+ (OAuth, basic auth, compose management, public bind,
+// docker socket, secret storage) is explicitly out of scope here.
+package webapp