fix: decouple lint stage from web-builder in Dockerfile

Remove COPY --from=web-builder from the lint stage so it can run
independently and fail fast. Create placeholder files for the
go:embed directive instead. The build stage still uses the real
SPA assets from web-builder.

Update README to reflect that lint no longer depends on web-builder.

README.md

@@ -1374,18 +1374,16 @@ Return server metadata. No authentication required.
 ```json
 {
   "name": "My NeoIRC Server",
-  "version": "0.1.0",
   "motd": "Welcome! Be nice.",
   "users": 42
 }
 ```
 
-| Field     | Type    | Description |
+| Field   | Type    | Description |
-|-----------|---------|-------------|
+|---------|---------|-------------|
-| `name`    | string  | Server display name |
+| `name`  | string  | Server display name |
-| `version` | string  | Server version |
+| `motd`  | string  | Message of the day |
-| `motd`    | string  | Message of the day |
+| `users` | integer | Number of currently active user sessions |
-| `users`   | integer | Number of currently active user sessions |
 
 ### GET /.well-known/healthcheck.json — Health Check
 

internal/handlers/api.go

@@ -2392,10 +2392,9 @@ func (hdlr *Handlers) HandleServerInfo() http.HandlerFunc {
 		}
 
 		hdlr.respondJSON(writer, request, map[string]any{
-			"name":    hdlr.params.Config.ServerName,
+			"name":  hdlr.params.Config.ServerName,
-			"version": hdlr.params.Globals.Version,
+			"motd":  hdlr.params.Config.MOTD,
-			"motd":    hdlr.params.Config.MOTD,
+			"users": users,
-			"users":   users,
 		}, http.StatusOK)
 	}
 }

internal/server/routes.go

@@ -16,11 +16,6 @@ import (
 
 const routeTimeout = 60 * time.Second
 
-// cspHeader is the Content-Security-Policy applied to the embedded web SPA.
-// The SPA loads external scripts and stylesheets from the same origin only;
-// all API communication uses same-origin fetch (no WebSockets).
-const cspHeader = "default-src 'self'; script-src 'self'; style-src 'self'"
-
 // SetupRoutes configures the HTTP routes and middleware.
 func (srv *Server) SetupRoutes() {
 	srv.router = chi.NewRouter()
@@ -138,11 +133,6 @@ func (srv *Server) setupSPA() {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		writer.Header().Set(
-			"Content-Security-Policy",
-			cspHeader,
-		)
-
 		readFS, ok := distFS.(fs.ReadFileFS)
 		if !ok {
 			fileServer.ServeHTTP(writer, request)