fix(web): tolerate absent dist at compile time via LookupDist

internal/server/static_assets.go

@@ -64,8 +64,8 @@ func serveSPAFromDisk(w http.ResponseWriter, r *http.Request, distDir string) {
 }
 
 func serveSPAFromEmbed(w http.ResponseWriter, r *http.Request) {
-	root, err := fs.Sub(web.DistFS, "dist")
-	if err != nil {
+	root, ok := web.LookupDist()
+	if !ok {
 		http.NotFound(w, r)
 		return
 	}

web/embed.go

@@ -1,11 +1,26 @@
 package web
 
-import "embed"
+import (
+	"embed"
+	"io/fs"
+)
 
 // DistFS holds the production SPA build (npm run build + precompress).
 // Build scripts must materialize web/dist before `go build`; the directory is
-// gitignored. At runtime the server prefers an on-disk web/dist when present
-// (dev Vite / hot reload) and falls back to this embed.
+// gitignored. When dist is absent (fresh checkout / CI vet), patterns embed
+// nothing and LookupDist returns false so callers fall back to disk-only mode.
 //
 //go:embed all:dist
 var DistFS embed.FS
+
+// LookupDist returns the embedded dist subtree when the build populated it.
+func LookupDist() (fs.FS, bool) {
+	sub, err := fs.Sub(DistFS, "dist")
+	if err != nil {
+		return nil, false
+	}
+	if _, err := fs.Stat(sub, "index.html"); err != nil {
+		return nil, false
+	}
+	return sub, true
+}