fix(dist): ship a self-contained bundle so it installs from the registry

The unscoped package lives on the Gitea npm registry but its deps span two
registries (`@punktfunk/host` on Gitea, `effect`/`undici` on npmjs). Installing
by name with `--registry <gitea>` sets the default registry for the whole tree,
so `effect` 404s (Gitea doesn't proxy npm), and an unscoped name can't be
scope-mapped. Fix: bundle the backend into ONE self-contained `dist/index.js`
(+ `dist/cli.js`) via `bun build --target=bun` with `@punktfunk/host` + `effect`
inlined — mirroring the scripting runner. The published package now has zero
runtime dependencies and installs with a single `--registry` flag.

- build → `bun build src/{index,cli}.ts --target=bun --outdir dist --external undici`
- @punktfunk/host + effect → devDependencies (bundled, not resolved at install)
- resolveUiDir(): walk to the SPA dir so staticDir works in the bundled
  (dist/index.js) and unbundled (dist/server/index.js) layouts
- version 0.1.0 → 0.1.1

Verified: the bundle loads + scans/detects/previews with NO node_modules present.

src/server/standalone.ts

@@ -4,10 +4,10 @@
 // non-loopback bind REQUIRES a password (a UI that can rewrite launch templates is host-user code).
 
 import * as nodePath from "node:path";
-import { fileURLToPath } from "node:url";
 import type { Config } from "../config.js";
 import type { Engine } from "../engine/index.js";
 import { log } from "../log.js";
+import { resolveUiDir } from "../paths.js";
 import { verifyPassword } from "./password.js";
 import { makeRouter } from "./router.js";
 
@@ -70,7 +70,7 @@ export const serveStandaloneUi = (
 	const authRequired = Boolean(passwordHash);
 	// A per-boot session token — any client presenting it in the cookie is authed until the plugin restarts.
 	const sessionToken = crypto.randomUUID().replace(/-/g, "");
-	const root = fileURLToPath(new URL("../../dist/ui", import.meta.url));
+	const root = resolveUiDir(import.meta.url);
 	const router = makeRouter(engine);
 
 	const authed = (req: Request) =>