Pin tailwindcss and check the committed stylesheet against it (closes #231)

make css now runs the Tailwind v4.2.1 standalone CLI in a docker build
stage, the binary pinned by sha256, instead of whatever tailwindcss is
on the host. A css-check stage, run by make check and required by the
image build, fails when static/css/tailwind.css differs from what make
css generates.

input.css now names its sources (the templates, app.js, and the Go file
that picks status colour classes) instead of letting Tailwind scan the
whole checkout, where words in Go code and docs became unused classes.
.btn-text is removed and tailwind.css regenerated; it only loses unused
rules.

Model: opus-5-5

script/bootstrap

@@ -60,9 +60,9 @@ main() {
     if missing go; then pkg_install go golang go go; fi
 
     # Not installed here: docker is platform-specific and out of scope for a
-    # package-manager bootstrap, but script/lint needs it.
+    # package-manager bootstrap, but script/lint and script/css need it.
     if missing docker; then
-        echo "bootstrap: docker not found; script/lint requires it" >&2
+        echo "bootstrap: docker not found; script/lint and script/css require it" >&2
     fi
 
     go mod download

script/check

@@ -1,8 +1,8 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
+# script/check: run all checks (test, lint, fmt-check, css-check). Our own
 # extension to scripts-to-rule-them-all.
 # Writes only the ignored static/js/alpine.min.js, through script/test.
-# Generic: usually needs no adaptation.
+# Generic, apart from css-check.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,6 +11,7 @@ main() {
     "$SCRIPT_DIR/test"
     "$SCRIPT_DIR/lint"
     "$SCRIPT_DIR/fmt-check"
+    "$SCRIPT_DIR/css-check"
 }
 
 main "$@"

script/css

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/css: regenerate static/css/tailwind.css (writes). tailwindcss is
+# never installed locally: it runs in docker, at the version and sha256
+# pinned in the Dockerfile's stylesheet stages, which also say what the
+# stylesheet is generated from.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --target css-output --output type=local,dest=static/css .
+}
+
+main "$@"

script/css-check

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/css-check: fail when static/css/tailwind.css differs from what
+# script/css would generate (read-only). The comparison is the Dockerfile's
+# css-check stage, which the image build runs too.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --target css-check --output type=cacheonly .
+}
+
+main "$@"