Dockerize the API with an embedded web UI, Fyne-for-Windows, and real releases

cmd/api/main.go: registerWebUI serves a built web/ as a single-page app -
Echo's static middleware in HTML5 mode, with a Skipper that exempts
/api/*, /hello, /docs, /schemas/* and openapi.json/.yaml so it can never
shadow a real API route. It reads WEB_DIST_DIR (default /frontend, where
the Dockerfile puts it) and no-ops if that directory doesn't exist, so
`go run ./cmd/api` and CI stay Node-free and API-only; only the Docker
image actually turns the web UI on.

Dockerfile: new node:22-alpine stage builds web/, copied into the final
image at /frontend alongside the existing Go-built binary. Added
.dockerignore (web/node_modules, web/dist, web/.angular, .git) now that a
second language's tooling is in the build context.

Looked at how your other Gitea projects (MusicServer et al.) structure
this, since I can't exercise Gitea Actions itself from here: MusicServer's
own Dockerfile already does "copy a prebuilt frontend into the Go image,
serve it from Go" (there, from a separately-published frontend image) -
registerWebUI does the same thing in spirit, just within one image rather
than two, since this UI isn't meant to be published separately.

release.yml:
- build-gui now also cross-compiles the Fyne GUI for windows/amd64 via
  mingw-w64, alongside the existing linux/amd64. Verified for real, not
  just written: installed mingw-w64 locally and cross-built cmd/gui,
  first plain (got a working PE32+ console exe), then with
  -ldflags "-H=windowsgui" (got the GUI-subsystem exe actually wanted, no
  console window). macOS isn't attempted - cgo has no equivalent
  cross-toolchain for Darwin and there's no registered macOS runner here.
- new build-docker job pushes the API image (now carrying the web build)
  to gitea.sanplex.xyz/sansan/completed, tagged with the version and
  latest.
- replaced the hand-rolled curl+jq Gitea-release creation with
  akkuman/gitea-release-action, and artifact upload with the Gitea generic
  package registry - both are what your other projects (HanjaKanaMun,
  MusicPlayer) actually use, found by reading their workflows rather than
  guessing. Same for the registry host, owner, and secrets.TOKEN name
  (previously secrets.GITHUB_TOKEN, which nothing else here uses).

ci.yml: new docker job builds the same image on every push to main/develop
(push: false) as a health check, matching MusicServer's build-vs-release
split.

Verified for real wherever I could: a full `docker build` of the new
Dockerfile, then running that image against a real Postgres container and
hitting it with curl - / serves the actual built Angular index.html,
/games (a client-side route) correctly falls back to it, /api/games and
/hello are untouched (still return real API responses, not shadowed by
the static handler), and register+list-games works end to end through the
container. Also ran it the documented way, `docker compose up --build`,
with the same results. Separately confirmed the Windows Fyne cross-build
produces a real, correctly-subsystemed .exe. What I could not run from
here is Gitea Actions itself - the workflow YAML is written to match your
other projects' established, working conventions, but its first real
execution on your Gitea instance is still the first real test of it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cmd/api/main.go

@@ -96,6 +96,45 @@ func runMigrations(dbURL string) error {
 	return nil
 }
 
+// reservedAPIPrefixes are the paths the API itself owns: everything under
+// /api, plus what Huma's default config registers for docs/schemas. The
+// web UI's SPA fallback (below) must never shadow these.
+var reservedAPIPrefixes = []string{"/api/", "/docs", "/schemas/", "/openapi.json", "/openapi.yaml", "/hello"}
+
+// registerWebUI serves the Angular build as a single-page app if one has
+// been placed at dir (WEB_DIST_DIR, default /frontend - matching where the
+// Dockerfile's web build stage copies it to). Unknown paths fall back to
+// index.html so Angular's router can handle a direct link to e.g. /games.
+//
+// Outside the Docker image, dir won't exist; this is a deliberate no-op in
+// that case; so `go run ./cmd/api` and the CI build keep working without
+// ever needing Node, and the API alone can still be deployed without a UI.
+func registerWebUI(e *echo.Echo) {
+	dir := os.Getenv("WEB_DIST_DIR")
+	if dir == "" {
+		dir = "/frontend"
+	}
+	if info, err := os.Stat(dir); err != nil || !info.IsDir() {
+		fmt.Printf("WEB_DIST_DIR %q not found; serving the API only, no web UI.\n", dir)
+		return
+	}
+
+	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
+		Root:  dir,
+		HTML5: true,
+		Skipper: func(c echo.Context) bool {
+			p := c.Request().URL.Path
+			for _, prefix := range reservedAPIPrefixes {
+				if strings.HasPrefix(p, prefix) {
+					return true
+				}
+			}
+			return false
+		},
+	}))
+	fmt.Printf("Serving the web UI from %q.\n", dir)
+}
+
 func main() {
 	dbURL := os.Getenv("DATABASE_URL")
 	if dbURL == "" {
@@ -144,6 +183,7 @@ func main() {
 	humaApi := humaecho.New(e, huma.DefaultConfig("Completed API", "1.0.0"))
 
 	api.RegisterRoutes(humaApi, queries)
+	registerWebUI(e)
 
 	port := os.Getenv("PORT")
 	if port == "" {