fix: remove build artifacts from repo, build SPA in Docker

- Remove web/dist/ from git tracking (build output)
- Add web/dist/ to .gitignore
- Add Node.js web-builder stage to Dockerfile to compile SPA at build time
- Update REPO_POLICIES.md from upstream sneak/prompts (build artifacts policy)

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-02-22
+last_modified: 2026-03-10
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -92,6 +92,14 @@ style conventions are in separate documents:
 - Never commit secrets. `.env` files, credentials, API keys, and private keys
   must be in `.gitignore`. No exceptions.
 
+- Build artifacts and code-derived data (compiled output, bundled JS, minified
+  CSS, generated code) must NOT be committed to the repository if they can be
+  generated during the build process. The Dockerfile or build system should
+  produce these artifacts at build time. Notable exception: Go
+  protobuf-generated files (`.pb.go`) may be committed because Go module
+  consumers use `go get` which downloads source code but does not execute build
+  steps.
+
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
   editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
   Fetch the standard `.gitignore` from
@@ -144,8 +152,14 @@ style conventions are in separate documents:
 - Use SemVer.
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
-  Post-1.0.0: add new migration files.
+  the binary.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
   settings.