Separate web UI into standalone metacrypt-web binary

The vault server holds in-memory unsealed state (KEK, engine keys) that
is lost on restart, requiring a full unseal ceremony. Previously the web
UI ran inside the vault process, so any UI change forced a restart and
re-unseal.

This change extracts the web UI into a separate metacrypt-web binary
that communicates with the vault over an authenticated gRPC connection.
The web server carries no sealed state and can be restarted freely.

- gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/
- internal/grpcserver/: full gRPC server implementation (System, Auth,
  Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors
- internal/webserver/: web server with gRPC vault client; templates
  embedded via web/embed.go (no runtime web/ directory needed)
- cmd/metacrypt-web/: standalone binary entry point
- internal/config: added [web] section (listen_addr, vault_grpc, etc.)
- internal/server/routes.go: removed all web UI routes and handlers
- cmd/metacrypt/server.go: starts gRPC server alongside HTTP server
- Deploy: Dockerfile builds both binaries, docker-compose adds
  metacrypt-web service, new metacrypt-web.service systemd unit,
  Makefile gains proto/metacrypt-web targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/grpcserver/interceptors.go

@@ -0,0 +1,107 @@
+package grpcserver
+
+import (
+	"context"
+	"strings"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"git.wntrmute.dev/kyle/metacrypt/internal/auth"
+	"git.wntrmute.dev/kyle/metacrypt/internal/seal"
+)
+
+type contextKey int
+
+const tokenInfoKey contextKey = iota
+
+func tokenInfoFromContext(ctx context.Context) *auth.TokenInfo {
+	v, _ := ctx.Value(tokenInfoKey).(*auth.TokenInfo)
+	return v
+}
+
+// authInterceptor validates the Bearer token from gRPC metadata and injects
+// *auth.TokenInfo into the context. The set of method full names that require
+// auth is passed in; all others pass through without validation.
+func authInterceptor(authenticator *auth.Authenticator, methods map[string]bool) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		if !methods[info.FullMethod] {
+			return handler(ctx, req)
+		}
+
+		token := extractToken(ctx)
+		if token == "" {
+			return nil, status.Error(codes.Unauthenticated, "missing authorization token")
+		}
+
+		tokenInfo, err := authenticator.ValidateToken(token)
+		if err != nil {
+			return nil, status.Error(codes.Unauthenticated, "invalid token")
+		}
+
+		ctx = context.WithValue(ctx, tokenInfoKey, tokenInfo)
+		return handler(ctx, req)
+	}
+}
+
+// adminInterceptor requires IsAdmin on the token info for the listed methods.
+// Must run after authInterceptor.
+func adminInterceptor(methods map[string]bool) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		if !methods[info.FullMethod] {
+			return handler(ctx, req)
+		}
+		ti := tokenInfoFromContext(ctx)
+		if ti == nil || !ti.IsAdmin {
+			return nil, status.Error(codes.PermissionDenied, "admin required")
+		}
+		return handler(ctx, req)
+	}
+}
+
+// sealInterceptor rejects calls with FailedPrecondition when the vault is
+// sealed, for the listed methods.
+func sealInterceptor(sealMgr *seal.Manager, methods map[string]bool) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		if !methods[info.FullMethod] {
+			return handler(ctx, req)
+		}
+		if sealMgr.State() != seal.StateUnsealed {
+			return nil, status.Error(codes.FailedPrecondition, "vault is sealed")
+		}
+		return handler(ctx, req)
+	}
+}
+
+// chainInterceptors reduces a slice of interceptors into a single one.
+func chainInterceptors(interceptors ...grpc.UnaryServerInterceptor) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		chain := handler
+		for i := len(interceptors) - 1; i >= 0; i-- {
+			next := chain
+			ic := interceptors[i]
+			chain = func(ctx context.Context, req interface{}) (interface{}, error) {
+				return ic(ctx, req, info, next)
+			}
+		}
+		return chain(ctx, req)
+	}
+}
+
+func extractToken(ctx context.Context) string {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return ""
+	}
+	vals := md.Get("authorization")
+	if len(vals) == 0 {
+		return ""
+	}
+	v := vals[0]
+	if strings.HasPrefix(v, "Bearer ") {
+		return strings.TrimPrefix(v, "Bearer ")
+	}
+	return v
+}