Build the web front end with yarn (closes #117)

web/yarn.lock replaces web/package-lock.json. yarn import converted
it, so it locks the same package versions with the same integrity
hashes. The web-builder stage pins yarn 1.22.22, the version
script/bootstrap pins, by its sha512 through corepack, and installs
with yarn install --frozen-lockfile. web/build.sh runs the esbuild
that yarn installed rather than npx or an esbuild found on the PATH.

Model: opus-5-5

web/build.sh

@@ -2,22 +2,16 @@
 set -e
 cd "$(dirname "$0")"
 
-# Install esbuild if not present
-if ! command -v esbuild >/dev/null 2>&1; then
-  if command -v npx >/dev/null 2>&1; then
-    NPX="npx"
-  else
-    echo "esbuild not found. Install it: npm install -g esbuild"
-    exit 1
-  fi
-else
-  NPX=""
+# The esbuild that yarn.lock pins, which yarn install puts in node_modules
+if [ ! -x node_modules/.bin/esbuild ]; then
+  echo "esbuild not found. Install it: yarn install --frozen-lockfile"
+  exit 1
 fi
 
 mkdir -p dist
 
 # Build JS bundle — preact must be bundled (no CDN/external loader)
-${NPX:+$NPX} esbuild src/app.jsx \
+node_modules/.bin/esbuild src/app.jsx \
   --bundle \
   --minify \
   --format=esm \