feat(spa-server): initial implementation — SPA/PWA container server (v1.0.0)

Introduces code.nochebuena.dev/einherjar/spa-server — a container-first HTTP
server for single-page applications and progressive web apps. Produces a Docker
base image; downstream SPA Dockerfiles require only a single COPY instruction.

Interfaces and types (CT-6: one TypeSpec per file):
- Config — Port (EINHERJAR_SPA_PORT, default 8080) and StaticDir
  (EINHERJAR_SPA_STATIC_DIR, default /srv/www); parsed via os.Getenv
- Server — implements lifecycle.Component; registered with launcher.New

Implementation:
- NewServer(logger, cfg) *Server — returns a lifecycle-managed HTTP server
- OnInit: builds http.NewServeMux with GET /health and /* routes
- OnStart: binds TCP listener synchronously via net.Listen (port conflicts
  surface immediately), then serves in a background goroutine
- OnStop: graceful shutdown via http.Server.Shutdown with 10s timeout

spa.NewHandler(logger, staticDir) http.Handler:
- Uses http.Dir.Open for path sanitisation (prevents directory traversal)
- File exists and is not a directory → served by http.FileServer
- File missing or is a directory → serves index.html (SPA router owns all routes)
- Directory listing is disabled

health.NewHandler(logger) http.Handler:
- Always responds 200 {"status":"UP","components":{}}
- Wire format matches web/health.Response without importing the web module
- No external checks — process reachability is the only meaningful health signal

Config (EINHERJAR_SPA_* env vars):
  Port(8080), StaticDir(/srv/www)

Docker:
- Multi-stage: golang:1.26-alpine builder → alpine:3.21 runtime
- Image published as:
    code.nochebuena.dev/einherjar/spa-server:v1.0.0
    code.nochebuena.dev/einherjar/spa-server:latest
- VOLUME ["/srv/www"] declared; consumer overrides via COPY or volume mount

No external dependencies beyond contracts, core, and the Go standard library.

CLA.md

@@ -0,0 +1,90 @@
+# Contributor License Agreement
+
+By contributing to any Einherjar repository, you agree to the terms of this Contributor License Agreement ("Agreement"). Please read it carefully before submitting your first Pull Request.
+
+---
+
+## 1. Definitions
+
+| Term | Meaning |
+|---|---|
+| **You** | The individual or legal entity submitting a Contribution |
+| **Contribution** | Any original work — source code, documentation, tests, configuration — submitted to an Einherjar repository |
+| **Project** | The Einherjar framework and all repositories under `code.nochebuena.dev/einherjar/` |
+| **Maintainers** | The individuals responsible for maintaining the Project |
+
+---
+
+## 2. You Retain Ownership
+
+This Agreement does **not** transfer your copyright to the Maintainers. You remain the legal owner of your Contribution. What you grant here is a broad license to use it — not ownership of it.
+
+---
+
+## 3. Copyright License Grant
+
+You grant the Maintainers and all recipients of the Project a **perpetual, worldwide, non-exclusive, royalty-free, irrevocable** license to:
+
+- Reproduce, modify, and create derivative works of your Contribution
+- Publicly display and perform your Contribution
+- Distribute your Contribution and derivative works, in source or compiled form, under any terms
+- Sublicense the above rights to third parties
+- **Relicense** your Contribution under a different open-source or commercial license at the Maintainers' sole discretion
+
+The Maintainers commit to keeping the Project available under at least one OSI-approved open-source license at all times.
+
+---
+
+## 4. Patent License Grant
+
+You grant the Maintainers and all recipients of the Project a **perpetual, worldwide, non-exclusive, royalty-free, irrevocable** patent license to make, use, sell, offer for sale, import, and distribute your Contribution — limited to patent claims you own or control that are necessarily infringed by your Contribution alone, or in combination with the Project to which you submitted it.
+
+---
+
+## 5. Your Representations
+
+By submitting a Contribution, you confirm that:
+
+1. **Original work.** The Contribution is your original work, or you have the legal right to submit it under these terms.
+2. **No infringement.** To your knowledge, the Contribution does not infringe any third-party intellectual property rights, including patents, copyrights, and trade secrets.
+3. **Employer rights.** If your employer holds rights over intellectual property you create, you have obtained written permission to submit the Contribution on behalf of that employer, or your employer has explicitly waived such rights for contributions to open-source projects.
+4. **No warranty implied.** You understand that your Contribution may or may not be included in the Project, and the Maintainers are under no obligation to use it.
+
+---
+
+## 6. No Support Obligation
+
+You are not required to provide maintenance, support, or updates for your Contributions. They are accepted **"as-is"**, without any warranty of fitness for a particular purpose or correctness.
+
+---
+
+## 7. How to Sign
+
+Consent is given by **posting a comment** on your Pull Request with the following exact text:
+
+```
+I have read the Einherjar Contributor License Agreement (CLA.md) and I agree to all its terms.
+I confirm this Contribution is my original work. I grant the Maintainers the rights described
+therein, including the right to relicense, and I retain ownership of my copyright.
+This agreement covers all future Contributions I submit to any Einherjar repository under
+this account.
+```
+
+**Why a comment and not a checkbox?**
+PR description checkboxes can be silently toggled on and off by anyone with write access to the branch at any time. A comment creates a timestamped, author-attributed record in the PR activity log — it cannot be quietly retracted. If a comment is deleted, the deletion itself is visible in the activity log.
+
+No handwritten or electronic signature is required beyond the comment above. A Maintainer will verify the comment before merging. PRs without the comment will not be merged.
+
+If you are contributing on behalf of a company or organization, ensure that an authorized representative of that entity has reviewed and accepted these terms before submitting. The comment must be posted by the account that owns the Contribution.
+
+---
+
+## 8. Governing Terms
+
+This Agreement is intended to be simple and broadly fair. It follows the model established by widely adopted CLAs from the Apache Software Foundation, Google, and MongoDB — granting the Project the flexibility to evolve while fully preserving your ownership of what you wrote.
+
+If any provision of this Agreement is found unenforceable, the remaining provisions continue in full effect.
+
+---
+
+*For those who come after. — The Einherjar Maintainers*