Separate web UI into standalone metacrypt-web binary

The vault server holds in-memory unsealed state (KEK, engine keys) that
is lost on restart, requiring a full unseal ceremony. Previously the web
UI ran inside the vault process, so any UI change forced a restart and
re-unseal.

This change extracts the web UI into a separate metacrypt-web binary
that communicates with the vault over an authenticated gRPC connection.
The web server carries no sealed state and can be restarted freely.

- gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/
- internal/grpcserver/: full gRPC server implementation (System, Auth,
  Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors
- internal/webserver/: web server with gRPC vault client; templates
  embedded via web/embed.go (no runtime web/ directory needed)
- cmd/metacrypt-web/: standalone binary entry point
- internal/config: added [web] section (listen_addr, vault_grpc, etc.)
- internal/server/routes.go: removed all web UI routes and handlers
- cmd/metacrypt/server.go: starts gRPC server alongside HTTP server
- Deploy: Dockerfile builds both binaries, docker-compose adds
  metacrypt-web service, new metacrypt-web.service systemd unit,
  Makefile gains proto/metacrypt-web targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -1,7 +1,17 @@
-.PHONY: build test vet clean docker all devserver metacrypt
+.PHONY: build test vet clean docker all devserver metacrypt metacrypt-web proto
+
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)"
+
+proto:
+	protoc --go_out=. --go_opt=paths=source_relative \
+		--go-grpc_out=. --go-grpc_opt=paths=source_relative \
+		proto/metacrypt/v1/*.proto
 
 metacrypt:
-	go build -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)" -o metacrypt ./cmd/metacrypt
+	go build $(LDFLAGS) -o metacrypt ./cmd/metacrypt
+
+metacrypt-web:
+	go build $(LDFLAGS) -o metacrypt-web ./cmd/metacrypt-web
 
 build:
 	go build ./...
@@ -13,7 +23,7 @@ vet:
 	go vet ./...
 
 clean:
-	rm -f metacrypt
+	rm -f metacrypt metacrypt-web
 
 docker:
 	docker build -t metacrypt .
@@ -21,7 +31,8 @@ docker:
 docker-compose:
 	docker compose -f deploy/docker/docker-compose.yml up --build
 
-devserver: metacrypt
-	./metacrypt server --config srv/metacrypt.toml
+devserver: metacrypt metacrypt-web
+	./metacrypt server --config srv/metacrypt.toml &
+	./metacrypt-web --config srv/metacrypt.toml
 
-all: vet test metacrypt
+all: vet test metacrypt metacrypt-web