Build the web front end with yarn (closes #117)

web/yarn.lock replaces web/package-lock.json. yarn import converted
it, so it locks the same package versions with the same integrity
hashes. The web-builder stage pins yarn 1.22.22, the version
script/bootstrap pins, by its sha512 through corepack, and installs
with yarn install --frozen-lockfile. web/build.sh runs the esbuild
that yarn installed rather than npx or an esbuild found on the PATH.

Model: opus-5-5

README.md

@@ -3020,7 +3020,7 @@ neoirc/
 │   ├── embed.go            # go:embed directive for SPA
 │   ├── build.sh            # SPA build script (esbuild, runs in Docker)
 │   ├── package.json        # Node dependencies (preact, esbuild)
-│   ├── package-lock.json
+│   ├── yarn.lock
 │   ├── src/                # SPA source files (JSX + HTML + CSS)
 │   │   ├── app.jsx
 │   │   ├── index.html