Separate web UI into standalone metacrypt-web binary

The vault server holds in-memory unsealed state (KEK, engine keys) that
is lost on restart, requiring a full unseal ceremony. Previously the web
UI ran inside the vault process, so any UI change forced a restart and
re-unseal.

This change extracts the web UI into a separate metacrypt-web binary
that communicates with the vault over an authenticated gRPC connection.
The web server carries no sealed state and can be restarted freely.

- gen/metacrypt/v1/: generated Go bindings from proto/metacrypt/v1/
- internal/grpcserver/: full gRPC server implementation (System, Auth,
  Engine, PKI, Policy, ACME services) with seal/auth/admin interceptors
- internal/webserver/: web server with gRPC vault client; templates
  embedded via web/embed.go (no runtime web/ directory needed)
- cmd/metacrypt-web/: standalone binary entry point
- internal/config: added [web] section (listen_addr, vault_grpc, etc.)
- internal/server/routes.go: removed all web UI routes and handlers
- cmd/metacrypt/server.go: starts gRPC server alongside HTTP server
- Deploy: Dockerfile builds both binaries, docker-compose adds
  metacrypt-web service, new metacrypt-web.service systemd unit,
  Makefile gains proto/metacrypt-web targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/server/server_test.go

@@ -151,18 +151,15 @@ func TestStatusMethodNotAllowed(t *testing.T) {
 	}
 }
 
-func TestRootRedirect(t *testing.T) {
+func TestRootNotFound(t *testing.T) {
 	_, _, mux := setupTestServer(t)
 
+	// The vault server no longer serves a web UI at /; that is handled by metacrypt-web.
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
 	mux.ServeHTTP(w, req)
-	if w.Code != http.StatusFound {
-		t.Errorf("root redirect: got %d, want %d", w.Code, http.StatusFound)
-	}
-	loc := w.Header().Get("Location")
-	if loc != "/init" {
-		t.Errorf("redirect location: got %q, want /init", loc)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("root: got %d, want %d", w.Code, http.StatusNotFound)
 	}
 }