refactor: migrate frontend to React + Tailwind, add Docker + tests

Replace the vanilla-TS innerHTML frontend with a type-checked React
component tree (React 19 + Tailwind v4 + Vite).

Frontend:
- 14 components: Header, Stepper, LoginPage, LoginModal, SignPage,
  DropZone, DevicePicker, ProgressCard, SavedAccountsList, TrustModal,
  TwoFactorModal, Button, Field, Chip, Modal
- lib/ extracts: storage (10 localStorage keys preserved), pair-record,
  account-session, log-parser, ids, use-log hook
- flows/ encapsulate async pair/login/sign/install with dependency injection
- Accounts page as main view with Add Account modal
- Fullscreen progress overlay during sign/install
- Account selector + device picker on Sign page
- Security notice in login modal (server trust warning)
- All addLog calls mirrored to console.log for devtools debugging

Build:
- bun run dev: submodule init + install + wasm dist + vite + wrangler
- bun run setup: one-shot project bootstrap
- Docker: multi-stage bun build → nginx on :3000
- build:wasm:dist copies pre-built src→dist (no Rust/Emscripten needed)
- jszip/node-forge/fflate pre-bundled for CJS→ESM conversion

Tests:
- 163 vitest tests (happy-dom): all lib, components, App integration,
  WASM dist artifact checks, libcurl Apple connectivity, anisette init
  error handling

Cleanup:
- Delete yarn.lock (bun.lock canonical), expand .gitignore
- Remove README.zh.md, rewrite README.md + AGENTS.md
- Update libcurl.js submodule to f65d440 (CI build artifacts)

Dockerfile

@@ -0,0 +1,29 @@
+# Multi-stage Docker build for the sideload.js frontend.
+
+# --- Stage 1: build ---
+FROM oven/bun:1.3-alpine AS build
+WORKDIR /app
+
+# Copy manifests first for dependency layer caching.
+COPY package.json bun.lock ./
+COPY frontend/package.json frontend/
+COPY backend/package.json backend/
+COPY dependencies/webmuxd/package.json dependencies/webmuxd/
+COPY wasm/openssl/package.json wasm/openssl/
+COPY wasm/libcurl-wasm/package.json wasm/libcurl-wasm/
+COPY wasm/zsign-wasm/package.json wasm/zsign-wasm/
+COPY wasm/zsign-wasm/js/package.json wasm/zsign-wasm/js/
+
+RUN bun install --frozen-lockfile --ignore-scripts
+
+# Copy all sources (filtered by .dockerignore).
+COPY . .
+
+# Build WASM dist bundles (src→dist copies) then frontend.
+RUN bun run build:wasm:dist && cd frontend && bun run build
+
+# --- Stage 2: serve ---
+FROM nginx:1.29-alpine
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/frontend/dist /usr/share/nginx/html
+EXPOSE 3000