feat(spa-server): initial implementation — SPA/PWA container server (v1.0.0)

Introduces code.nochebuena.dev/einherjar/spa-server — a container-first HTTP
server for single-page applications and progressive web apps. Produces a Docker
base image; downstream SPA Dockerfiles require only a single COPY instruction.

Interfaces and types (CT-6: one TypeSpec per file):
- Config — Port (EINHERJAR_SPA_PORT, default 8080) and StaticDir
  (EINHERJAR_SPA_STATIC_DIR, default /srv/www); parsed via os.Getenv
- Server — implements lifecycle.Component; registered with launcher.New

Implementation:
- NewServer(logger, cfg) *Server — returns a lifecycle-managed HTTP server
- OnInit: builds http.NewServeMux with GET /health and /* routes
- OnStart: binds TCP listener synchronously via net.Listen (port conflicts
  surface immediately), then serves in a background goroutine
- OnStop: graceful shutdown via http.Server.Shutdown with 10s timeout

spa.NewHandler(logger, staticDir) http.Handler:
- Uses http.Dir.Open for path sanitisation (prevents directory traversal)
- File exists and is not a directory → served by http.FileServer
- File missing or is a directory → serves index.html (SPA router owns all routes)
- Directory listing is disabled

health.NewHandler(logger) http.Handler:
- Always responds 200 {"status":"UP","components":{}}
- Wire format matches web/health.Response without importing the web module
- No external checks — process reachability is the only meaningful health signal

Config (EINHERJAR_SPA_* env vars):
  Port(8080), StaticDir(/srv/www)

Docker:
- Multi-stage: golang:1.26-alpine builder → alpine:3.21 runtime
- Image published as:
    code.nochebuena.dev/einherjar/spa-server:v1.0.0
    code.nochebuena.dev/einherjar/spa-server:latest
- VOLUME ["/srv/www"] declared; consumer overrides via COPY or volume mount

No external dependencies beyond contracts, core, and the Go standard library.

spa/handler.go

@@ -0,0 +1,46 @@
+// Package spa provides the HTTP handler that serves a single-page application.
+package spa
+
+import (
+	"net/http"
+	"path/filepath"
+
+	"code.nochebuena.dev/einherjar/contracts/logging"
+)
+
+type handler struct {
+	logger    logging.Logger
+	staticDir string
+	fs        http.Handler
+}
+
+// NewHandler returns an http.Handler that serves static files from staticDir.
+// Requests for paths that exist on disk are served directly.
+// Any other path receives index.html, delegating routing to the SPA.
+func NewHandler(logger logging.Logger, staticDir string) http.Handler {
+	return &handler{
+		logger:    logger,
+		staticDir: staticDir,
+		fs:        http.FileServer(http.Dir(staticDir)),
+	}
+}
+
+func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// http.Dir.Open sanitises the path, preventing directory traversal.
+	f, err := http.Dir(h.staticDir).Open(r.URL.Path)
+	if err != nil {
+		// Path does not exist — hand off to the SPA router.
+		http.ServeFile(w, r, filepath.Join(h.staticDir, "index.html"))
+		return
+	}
+	defer f.Close()
+
+	stat, err := f.Stat()
+	if err != nil || stat.IsDir() {
+		// Directory listing is disabled; treat directories as SPA routes.
+		http.ServeFile(w, r, filepath.Join(h.staticDir, "index.html"))
+		return
+	}
+
+	h.fs.ServeHTTP(w, r)
+}