feat(spa-server): initial implementation — SPA/PWA container server (v1.0.0)

Introduces code.nochebuena.dev/einherjar/spa-server — a container-first HTTP
server for single-page applications and progressive web apps. Produces a Docker
base image; downstream SPA Dockerfiles require only a single COPY instruction.

Interfaces and types (CT-6: one TypeSpec per file):
- Config — Port (EINHERJAR_SPA_PORT, default 8080) and StaticDir
  (EINHERJAR_SPA_STATIC_DIR, default /srv/www); parsed via os.Getenv
- Server — implements lifecycle.Component; registered with launcher.New

Implementation:
- NewServer(logger, cfg) *Server — returns a lifecycle-managed HTTP server
- OnInit: builds http.NewServeMux with GET /health and /* routes
- OnStart: binds TCP listener synchronously via net.Listen (port conflicts
  surface immediately), then serves in a background goroutine
- OnStop: graceful shutdown via http.Server.Shutdown with 10s timeout

spa.NewHandler(logger, staticDir) http.Handler:
- Uses http.Dir.Open for path sanitisation (prevents directory traversal)
- File exists and is not a directory → served by http.FileServer
- File missing or is a directory → serves index.html (SPA router owns all routes)
- Directory listing is disabled

health.NewHandler(logger) http.Handler:
- Always responds 200 {"status":"UP","components":{}}
- Wire format matches web/health.Response without importing the web module
- No external checks — process reachability is the only meaningful health signal

Config (EINHERJAR_SPA_* env vars):
  Port(8080), StaticDir(/srv/www)

Docker:
- Multi-stage: golang:1.26-alpine builder → alpine:3.21 runtime
- Image published as:
    code.nochebuena.dev/einherjar/spa-server:v1.0.0
    code.nochebuena.dev/einherjar/spa-server:latest
- VOLUME ["/srv/www"] declared; consumer overrides via COPY or volume mount

No external dependencies beyond contracts, core, and the Go standard library.

server.go

@@ -0,0 +1,74 @@
+package spaserver
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+
+	"code.nochebuena.dev/einherjar/contracts/logging"
+	"code.nochebuena.dev/einherjar/spa-server/health"
+	"code.nochebuena.dev/einherjar/spa-server/spa"
+)
+
+const shutdownTimeout = 10 * time.Second
+
+// Server is a lifecycle-managed HTTP server that serves a single-page application.
+// Register with [launcher.New] via Append — it implements [lifecycle.Component].
+type Server struct {
+	logger logging.Logger
+	cfg    Config
+	srv    *http.Server
+}
+
+// NewServer returns a Server configured by cfg.
+func NewServer(logger logging.Logger, cfg Config) *Server {
+	return &Server{logger: logger, cfg: cfg}
+}
+
+// OnInit builds the HTTP mux and configures the underlying http.Server.
+func (s *Server) OnInit() error {
+	mux := http.NewServeMux()
+	mux.Handle("GET /health", health.NewHandler(s.logger))
+	mux.Handle("/", spa.NewHandler(s.logger, s.cfg.StaticDir))
+
+	s.srv = &http.Server{
+		Addr:    fmt.Sprintf(":%d", s.cfg.Port),
+		Handler: mux,
+	}
+	return nil
+}
+
+// OnStart begins serving HTTP requests in a background goroutine.
+// The TCP listener binds synchronously so a port conflict surfaces immediately.
+func (s *Server) OnStart() error {
+	ln, err := newListener(s.srv.Addr)
+	if err != nil {
+		return err
+	}
+	s.logger.Info("spa-server: listening", "addr", s.srv.Addr, "static_dir", s.cfg.StaticDir)
+	go func() {
+		if err := s.srv.Serve(ln); err != nil && err != http.ErrServerClosed {
+			s.logger.Error("spa-server: serve error", err)
+		}
+	}()
+	return nil
+}
+
+func newListener(addr string) (net.Listener, error) {
+	ln, err := net.Listen("tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("spa-server: bind %s: %w", addr, err)
+	}
+	return ln, nil
+}
+
+// OnStop performs a graceful shutdown, waiting up to 10 seconds for in-flight
+// requests to complete before forcefully closing connections.
+func (s *Server) OnStop() error {
+	s.logger.Info("spa-server: shutting down")
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+	defer cancel()
+	return s.srv.Shutdown(ctx)
+}