feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/templates/settings.html

@@ -0,0 +1,31 @@
+{{define "body"}}<section class="card">
+  <h1>Settings</h1>
+  <p class="muted">Phase 1 exposes only the worker fields; web-app settings (theme, session timeout, basic-auth password rotate) land in later phases.</p>
+
+  <h2>Worker</h2>
+  <dl>
+    <dt>Worker ID</dt><dd>{{.WorkerID}}</dd>
+    <dt>Region</dt><dd>{{.RegionCode}}</dd>
+    <dt>Version</dt><dd>{{.WorkerVersion}}</dd>
+    <dt>Capabilities</dt><dd>
+      {{if .Capabilities}}
+        <ul>{{range .Capabilities}}<li><code>{{.}}</code></li>{{end}}</ul>
+      {{else}}<span class="muted">—</span>{{end}}
+    </dd>
+    <dt>Last heartbeat ack</dt><dd>{{fmtTime .LastAckAt}}</dd>
+  </dl>
+
+  <h2>Token</h2>
+  <p>
+    Current token: <code>{{.TokenMasked}}</code><br>
+    Last rotated: {{fmtTime .TokenRotatedAt}}
+  </p>
+  <form action="/settings/rotate-token" method="post">
+    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+    <button type="submit" class="danger"
+      onclick="return confirm('Rotate the worker token? The old token will be invalidated immediately and the websocket will reconnect with the new one.')">
+      Rotate token
+    </button>
+    <span class="muted">Issues a fresh token via the main app API and updates the in-memory runner config. On failure the old token is kept.</span>
+  </form>
+</section>{{end}}