fix(embed): untrack web/frontend/dist/* and serve a fallback stub (#473)

The .gitignore already declares `web/frontend/` "auto-generated", and
every documented build path (`make build`, `make build-server`, the
release.yml + pr-build.yml CI workflows, the frontend/README.md
"Production Deployment" recipe) regenerates the bundle from source.
But the 39+ files under web/frontend/dist/ have been tracked since
a27d360, which means every `make frontend-build` produces a flood of
"deleted old-hash" + "untracked-but-gitignored new-hash" entries in
`git status`.

This commit brings the tracked state in line with the maintainers'
stated intent.

Changes:

1. `git rm --cached -r web/frontend/` removes the tracked Vite output.
2. Track `web/frontend/dist/.gitkeep` so //go:embed has at least one
   file to embed on a fresh module fetch.
3. Track `web/embedded_fallback/index.html`, a small stub UI shown
   when no real Vite bundle is present.
4. Change the embed directive in web/web.go to `all:frontend/dist`
   (required to pick up the dotfile placeholder) and add a second
   embed for the fallback. The handler falls back to the stub when
   index.html isn't found in the real bundle.
5. `.gitignore` gains explicit re-include lines so the new .gitkeep
   survives the generic `dist/` ignore rule earlier in the file.
6. Makefile's `frontend-build` recreates `.gitkeep` after copying the
   freshly built dist into web/frontend/, so subsequent rebuilds
   leave a clean `git status`.

User-visible behavior:

| Flow                                    | Before              | After                  |
|-----------------------------------------|---------------------|------------------------|
| `make build` from a clean tree          | dirty tree after    | clean tree after       |
| `make build` re-run                     | dirty tree after    | clean tree after       |
| Bare `go build ./cmd/mcpproxy`          | stale embedded UI   | fallback stub at /ui/  |
| `go install …@latest` (no npm)          | stale embedded UI   | fallback stub at /ui/  |
| Docker / .deb / DMG release             | uses `make build`   | unchanged              |
| CI release.yml / pr-build.yml           | always rebuilds     | unchanged              |

The trade-off is that bare-Go-toolchain users (no npm) now get a stub
UI with a "build from source for the real UI" message instead of a
silently-stale bundle. The REST API, MCP endpoints, and CLI are
unaffected — only the `/ui/` route changes.

Verified:
- `go build ./...` succeeds
- `make frontend-build` produces a clean `git status`
- After wiping web/frontend/dist/* except .gitkeep, bare
  `go build ./cmd/mcpproxy` compiles and the binary serves the
  fallback HTML at /ui/
- `git archive HEAD | tar -x -C tmp && cd tmp && go build ./cmd/mcpproxy`
  (the `go install` module-fetch simulation) produces the same fallback
  behaviour

Author: electrolobzik

.gitignore

@@ -81,8 +81,16 @@ frontend/.output/
 frontend/.cache/
 frontend/coverage/
 
-# Embedded frontend assets (auto-generated)
-web/frontend/
+# Embedded frontend assets (auto-generated by `make frontend-build`).
+# Everything under web/frontend/dist/ is rebuilt from frontend/ on every
+# `make build`, except the tracked .gitkeep — it exists only so that the
+# //go:embed all:frontend/dist directive in web/web.go can compile from a
+# fresh module fetch (e.g. `go install …@latest`) before the real UI has
+# been produced. The explicit re-includes are needed because the generic
+# `dist/` rule above would otherwise mask web/frontend/dist entirely.
+!web/frontend/dist/
+web/frontend/dist/*
+!web/frontend/dist/.gitkeep
 
 # Test coverage
 coverage.out

Makefile

@@ -74,8 +74,13 @@ frontend-build:
 	cd frontend && npm install && npm run build
 	@echo "📁 Copying dist files for embedding..."
 	rm -rf web/frontend
-	mkdir -p web/frontend
-	cp -r frontend/dist web/frontend/
+	mkdir -p web/frontend/dist
+	cp -r frontend/dist/. web/frontend/dist/
+	# Recreate the tracked .gitkeep so //go:embed all:frontend/dist still has
+	# something to embed even before the real UI is built (e.g. on a fresh
+	# `go install …@latest`), and so subsequent rebuilds don't show a phantom
+	# "deleted .gitkeep" in `git status`.
+	touch web/frontend/dist/.gitkeep
 	@echo "✅ Frontend build completed"
 
 # Start frontend development server

web/embedded_fallback/index.html

@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>MCPProxy — Web UI not built</title>
+  <style>
+    :root { color-scheme: light dark; }
+    body { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; max-width: 42rem; margin: 4rem auto; padding: 0 1rem; line-height: 1.55; }
+    h1 { font-size: 1.25rem; margin-bottom: 0.5rem; }
+    p { margin: 0.75rem 0; }
+    code, pre { font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 0.95em; }
+    pre { background: rgba(127,127,127,0.12); padding: 0.75rem 1rem; border-radius: 6px; overflow-x: auto; }
+    a { color: inherit; }
+  </style>
+</head>
+<body>
+  <h1>MCPProxy Web UI is not embedded in this build</h1>
+  <p>
+    This binary was built without running the frontend build step, so the
+    React/Vue UI assets are not embedded. The REST API and MCP endpoints
+    still work normally — this fallback page only replaces the
+    <code>/ui/</code> route.
+  </p>
+  <p>
+    If you installed mcpproxy with <code>go install …@latest</code> or
+    bare <code>go build ./cmd/mcpproxy</code>, this is expected: the Go
+    toolchain doesn't run <code>npm</code>. To get the real UI, either
+    install a release artifact (DMG, Homebrew, .deb, .rpm, AUR, Docker)
+    or build from source with:
+  </p>
+  <pre>make build       # full build (swagger + frontend + backend)
+make build-server  # server edition</pre>
+  <p>
+    See <a href="https://github.com/smart-mcp-proxy/mcpproxy-go#installation">the project README</a> for details.
+  </p>
+</body>
+</html>