Pin tailwindcss and check the committed stylesheet against it (closes #231)

make css now runs the Tailwind v4.2.1 standalone CLI in a docker build
stage, the binary pinned by sha256, instead of whatever tailwindcss is
on the host. A css-check stage, run by make check and required by the
image build, fails when static/css/tailwind.css differs from what make
css generates.

input.css now names its sources (the templates, app.js, and the Go file
that picks status colour classes) instead of letting Tailwind scan the
whole checkout, where words in Go code and docs became unused classes.
.btn-text is removed and tailwind.css regenerated; it only loses unused
rules.

Model: opus-5-5

static/css/input.css

@@ -1,7 +1,10 @@
-@import "tailwindcss";
-
-/* Source the templates */
+/* Classes are taken only from the files named below. A class written in
+   any other file is not generated: name that file here too. */
+@import "tailwindcss" source(none);
 @source "../../templates/**/*.html";
+@source "../js/app.js";
+/* targetStatus picks a target's status colour class */
+@source "../../internal/handlers/recent_events.go";
 
 /* Material Design inspired theme customization */
 @theme {
@@ -53,10 +56,6 @@
     @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed bg-error-500 text-white hover:bg-error-700 active:bg-red-800 focus:ring-red-500 shadow-elevation-1 hover:shadow-elevation-2;
   }
 
-  .btn-text {
-    @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed text-primary-600 hover:bg-primary-50 active:bg-primary-100;
-  }
-
   /* Cards */
   .card {
     @apply bg-white rounded-lg shadow-elevation-1 overflow-hidden;