feat: embed templates and static assets with go:embed for distroless containers

Replace all runtime template.ParseFiles() calls with template.ParseFS()
using an embedded filesystem, and serve static assets from an embedded FS
via http.FileServerFS(). This eliminates the need for COPY steps in the
Dockerfile and ensures the binary works with readOnlyRootFilesystem: true.

- Add internal/templates/embed.go exposing templates.FS
- Add static/embed.go exposing static.FS
- Update all handlers to use template.ParseFS(templates.FS, ...)
- Update static file server to use http.FileServerFS(static.FS)
- Remove COPY static/ and COPY internal/templates/ from Dockerfile
- Remove TestMain working directory hack (no longer needed)

Closes leeworks-agents/gitea-mobile#231
Closes leeworks-agents/gitea-mobile#220
Closes leeworks-agents/gitea-mobile#221

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handlers/settings.go

@@ -8,10 +8,9 @@ import (
 
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/auth"
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/middleware"
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/templates"
 )
 
-const settingsTemplatePath = "internal/templates/settings.html"
-
 // SettingsHandler handles GET and POST requests for the settings page.
 type SettingsHandler struct {
 	SessionSecret string
@@ -101,7 +100,7 @@ func (h *SettingsHandler) renderWithMessage(w http.ResponseWriter, r *http.Reque
 }
 
 func (h *SettingsHandler) renderSettings(w http.ResponseWriter, data settingsData) {
-	tmpl, err := template.ParseFiles(settingsTemplatePath)
+	tmpl, err := template.ParseFS(templates.FS, "settings.html")
 	if err != nil {
 		slog.Error("failed to parse settings template", "error", err)
 		http.Error(w, "template error", http.StatusInternalServerError)