vendor Tailwind CSS, embed all static assets in binary

Remove CDN dependency (cdn.tailwindcss.com) and replace with a
pre-built, minified Tailwind CSS file embedded in the Go binary
via go:embed.

Changes:
- Add static/static.go with go:embed for css/ directory
- Add static/css/tailwind.min.css (9KB, contains only classes
  used by the dashboard template)
- Remove <script src="https://cdn.tailwindcss.com"> and inline
  tailwind.config from dashboard.html
- Replace with <link rel="stylesheet" href="/s/css/tailwind.min.css">
- Mount /s/ route for embedded static file serving (go-chi)
- Add /.well-known/healthcheck endpoint per GO_HTTP_SERVER conventions

Zero external HTTP requests from the browser. All assets served
from the binary itself.

Closes #82

README.md

@@ -145,6 +145,10 @@ seconds.
 The dashboard intentionally does not expose any configuration details
 such as webhook URLs, notification endpoints, or API tokens.
 
+All assets (CSS) are embedded in the binary and served from the
+application itself. The dashboard makes zero external HTTP requests —
+no CDN dependencies or third-party resources are loaded at runtime.
+
 ### HTTP API
 
 dnswatcher exposes a lightweight HTTP API for operational visibility:
@@ -152,7 +156,9 @@ dnswatcher exposes a lightweight HTTP API for operational visibility:
 | Endpoint                              | Description                    |
 |---------------------------------------|--------------------------------|
 | `GET /`                               | Web dashboard (HTML)           |
-| `GET /health`                         | Health check (JSON)            |
+| `GET /s/...`                          | Static assets (embedded CSS)   |
+| `GET /.well-known/healthcheck`        | Health check (JSON)            |
+| `GET /health`                         | Health check (JSON, legacy)    |
 | `GET /api/v1/status`                  | Current monitoring state       |
 | `GET /metrics`                        | Prometheus metrics (optional)  |