feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/templates/login.html

@@ -0,0 +1,33 @@
+{{define "body"}}<section class="card login">
+  <h1>RSMon worker login</h1>
+  {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
+  <form action="/web/login" method="post" autocomplete="off">
+    <input type="hidden" name="next" value="{{.NextURL}}">
+    {{if .BasicAuth}}
+    <label>
+      Username
+      <input type="text" name="login" autocomplete="username" autofocus required value="">
+    </label>
+    {{end}}
+    <label>
+      Password
+      <input type="password" name="password" autocomplete="current-password" {{if not .BasicAuth}}autofocus{{end}} required minlength="1">
+    </label>
+    <button type="submit">Sign in</button>
+  </form>
+  {{if .BasicAuth}}
+  <p class="muted">
+    This worker is configured with HTTP basic auth
+    (<code>WORKER_LOGIN</code>/<code>WORKER_PASSWORD</code>). Use the
+    credentials from your environment. You can also pass them as
+    <code>Authorization: Basic</code> on
+    <code>/web/api/*</code> for scripted access.
+  </p>
+  {{else}}
+  <p class="muted">
+    On first start the worker printed a one-time password to its log.
+    Read it via <code>journalctl -u rsmon-worker</code> or your
+    container runtime.
+  </p>
+  {{end}}
+</section>{{end}}