feat(gateway): support external web UI assets for distro and docker builds

[penso]

Summary

• Split gateway web UI feature wiring into web-ui (routes/templates) and web-ui-embedded-assets (static embedding).
• Add filesystem-first asset resolution with precedence: MOLTIS_ASSETS_DIR -> compiled MOLTIS_DEFAULT_ASSETS_DIR -> dev source path -> embedded fallback.
• Add startup fail-fast validation when binary is built without embedded assets and required files are missing.
• Preserve cache-busting by hashing packaged filesystem assets in production mode.
• Update Docker build/runtime to ship external assets in /usr/share/moltis/assets.
• Update deb/rpm/Homebrew packaging and release workflows to install/distribute assets with no-embed binaries.
• Add and update docs (docs/src/web-ui-assets.md, Docker/index links) and changelog entries.

Validation

Completed

• taplo fmt
• just format
• cargo test -p moltis-gateway sanitize_asset_path -- --nocapture
• cargo check -p moltis
• cargo check -p moltis --no-default-features --features "file-watcher,local-llm,metrics,prometheus,push-notifications,qmd,tailscale,tls,voice,web-ui"
• cargo check -p moltis --no-default-features --features "file-watcher,tailscale,tls,web-ui,web-ui-embedded-assets"
• cargo +nightly-2025-11-30 clippy -Z unstable-options --workspace --all-targets --timings -- -D warnings

Remaining

• cargo +nightly-2025-11-30 clippy -Z unstable-options --workspace --all-features --all-targets --timings -- -D warnings

Reason: this environment does not have CUDA (nvcc) available; --all-features pulls CUDA build paths. Used the documented macOS fallback clippy invocation above.

Manual QA

1. Build non-embedded variant and verify startup fails when no assets dir is available.
2. Set MOLTIS_ASSETS_DIR to a valid assets directory and verify / and /assets/style.css load.
3. Verify Docker image serves assets from /usr/share/moltis/assets and UI loads at /.
4. Verify Homebrew-installed wrapper exports MOLTIS_ASSETS_DIR and UI loads.

[codspeed-hq]

Merging this PR will not alter performance

✅ 39 untouched benchmarks
⏩ 5 skipped benchmarks¹

---

_{Comparing no-assets-built-in (92baaea) with main (603cd7c)}

Footnotes

1. 5 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[codecov]

Codecov Report

❌ Patch coverage is 27.38854% with 114 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/gateway/src/server.rs	27.02%	108 Missing ⚠️
crates/gateway/src/chat.rs	0.00%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!