feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/templates/change_password.html

@@ -0,0 +1,21 @@
+{{define "body"}}<section class="card">
+  <h1>Change password</h1>
+  <p class="muted">The operator must change the first-run password before they can use the worker web app.</p>
+  {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
+  <form action="/web/change-password" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+    <label>
+      Current password
+      <input type="password" name="current_password" required>
+    </label>
+    <label>
+      New password (min {{.MinStrength}} chars)
+      <input type="password" name="new_password" required minlength="{{.MinStrength}}">
+    </label>
+    <label>
+      Confirm new password
+      <input type="password" name="new_password_confirm" required minlength="{{.MinStrength}}">
+    </label>
+    <button type="submit">Save</button>
+  </form>
+</section>{{end}}