vendor Tailwind CSS, embed all static assets in binary

Remove CDN dependency (cdn.tailwindcss.com) and replace with a
pre-built, minified Tailwind CSS file embedded in the Go binary
via go:embed.

Changes:
- Add static/static.go with go:embed for css/ directory
- Add static/css/tailwind.min.css (9KB, contains only classes
  used by the dashboard template)
- Remove <script src="https://cdn.tailwindcss.com"> and inline
  tailwind.config from dashboard.html
- Replace with <link rel="stylesheet" href="/s/css/tailwind.min.css">
- Mount /s/ route for embedded static file serving (go-chi)
- Add /.well-known/healthcheck endpoint per GO_HTTP_SERVER conventions

Zero external HTTP requests from the browser. All assets served
from the binary itself.

Closes #82

internal/server/routes.go

@@ -1,11 +1,14 @@
 package server
 
 import (
+	"net/http"
 	"time"
 
 	"github.com/go-chi/chi/v5"
 	chimw "github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"sneak.berlin/go/dnswatcher/static"
 )
 
 // requestTimeout is the maximum duration for handling a request.
@@ -25,7 +28,22 @@ func (s *Server) SetupRoutes() {
 	// Dashboard (read-only web UI)
 	s.router.Get("/", s.handlers.HandleDashboard())
 
-	// Health check
+	// Static assets (embedded CSS/JS)
+	s.router.Mount(
+		"/s",
+		http.StripPrefix(
+			"/s",
+			http.FileServer(http.FS(static.Static)),
+		),
+	)
+
+	// Health check (standard well-known path)
+	s.router.Get(
+		"/.well-known/healthcheck",
+		s.handlers.HandleHealthCheck(),
+	)
+
+	// Legacy health check (keep for backward compatibility)
 	s.router.Get("/health", s.handlers.HandleHealthCheck())
 
 	// API v1 routes