Pin tailwindcss and check the committed stylesheet against it (closes #231)

make css now runs the standalone tailwindcss CLI, v4.2.1, pinned by
sha256, in a build stage of the Dockerfile instead of whatever
tailwindcss is on the host. A css-check stage, run by make check and
required by the image build, fails when static/css/tailwind.css differs
from what make css generates.

input.css now names its sources (the templates, app.js, and the Go file
that picks status colour classes) instead of letting the whole checkout
be scanned, where words in Go code and docs became unused classes.
.btn-text is removed and tailwind.css regenerated; it only loses unused
rules.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup assets test test-browser lint fmt fmt-check check build run dev deps docker clean hooks css version
+.PHONY: bootstrap setup assets test test-browser lint fmt fmt-check check build run dev deps docker clean hooks css css-check version
 
 # Default target
 .DEFAULT_GOAL := check
@@ -74,4 +74,7 @@ hooks:
 	@script/install-precommit
 
 css:
-	tailwindcss -i static/css/input.css -o static/css/tailwind.css --minify
+	@script/css
+
+css-check:
+	@script/css-check