refactor: migrate frontend to React + Tailwind, add Docker + tests

Replace the vanilla-TS innerHTML frontend with a type-checked React
component tree (React 19 + Tailwind v4 + Vite).

Frontend:
- 14 components: Header, Stepper, LoginPage, LoginModal, SignPage,
  DropZone, DevicePicker, ProgressCard, SavedAccountsList, TrustModal,
  TwoFactorModal, Button, Field, Chip, Modal
- lib/ extracts: storage (10 localStorage keys preserved), pair-record,
  account-session, log-parser, ids, use-log hook
- flows/ encapsulate async pair/login/sign/install with dependency injection
- Accounts page as main view with Add Account modal
- Fullscreen progress overlay during sign/install
- Account selector + device picker on Sign page
- Security notice in login modal (server trust warning)
- All addLog calls mirrored to console.log for devtools debugging

Build:
- bun run dev: submodule init + install + wasm dist + vite + wrangler
- bun run setup: one-shot project bootstrap
- Docker: multi-stage bun build → nginx on :3000
- build:wasm:dist copies pre-built src→dist (no Rust/Emscripten needed)
- jszip/node-forge/fflate pre-bundled for CJS→ESM conversion

Tests:
- 163 vitest tests (happy-dom): all lib, components, App integration,
  WASM dist artifact checks, libcurl Apple connectivity, anisette init
  error handling

Cleanup:
- Delete yarn.lock (bun.lock canonical), expand .gitignore
- Remove README.zh.md, rewrite README.md + AGENTS.md
- Update libcurl.js submodule to f65d440 (CI build artifacts)

.dockerignore

@@ -0,0 +1,61 @@
+# VCS / editor
+.git
+.github
+.gitignore
+.gitmodules
+.prettierrc
+.idea
+.vscode
+.DS_Store
+
+# Markdown / docs
+*.md
+!README.md
+LICENSE
+
+# Node / TS caches
+**/node_modules
+frontend/dist
+**/build
+**/out
+**/.cache
+**/.turbo
+**/.vite
+**/*.tsbuildinfo
+**/*.log
+
+# Env
+.env
+.env.local
+.env.*.local
+
+# Backend sources not needed for frontend build, but package.json is needed
+# for workspace resolution during bun install.
+backend/src
+backend/worker-configuration.d.ts
+backend/wrangler.jsonc
+
+# WASM SOURCES — we only need the pre-built dist/binary outputs.
+# Source checkouts include large vendored OpenSSL copies, Rust target dirs, etc.
+# WASM native build artifacts (Rust/Emscripten) — only src/dist/binary/pkg needed
+wasm/openssl/vendor
+wasm/openssl/target
+wasm/openssl/precompiled
+wasm/libcurl-wasm/client/build
+wasm/libcurl-wasm/client/out
+wasm/libcurl-wasm/client/fragments
+wasm/libcurl-wasm/server
+wasm/zsign-wasm/native
+wasm/zsign-wasm/build
+wasm/zsign-wasm/test
+
+# Tests / scripts not needed at runtime
+dependencies/webmuxd/src/__tests__
+scripts
+
+# Docker meta
+Dockerfile
+.dockerignore
+
+# Frontend public anisette libs are shipped via Vite public/ handling —
+# keep them, but strip other platform natives if present.