refactor: migrate frontend to React + Tailwind, add Docker + tests

Replace the vanilla-TS innerHTML frontend with a type-checked React
component tree (React 19 + Tailwind v4 + Vite).

Frontend:
- 14 components: Header, Stepper, LoginPage, LoginModal, SignPage,
  DropZone, DevicePicker, ProgressCard, SavedAccountsList, TrustModal,
  TwoFactorModal, Button, Field, Chip, Modal
- lib/ extracts: storage (10 localStorage keys preserved), pair-record,
  account-session, log-parser, ids, use-log hook
- flows/ encapsulate async pair/login/sign/install with dependency injection
- Accounts page as main view with Add Account modal
- Fullscreen progress overlay during sign/install
- Account selector + device picker on Sign page
- Security notice in login modal (server trust warning)
- All addLog calls mirrored to console.log for devtools debugging

Build:
- bun run dev: submodule init + install + wasm dist + vite + wrangler
- bun run setup: one-shot project bootstrap
- Docker: multi-stage bun build → nginx on :3000
- build:wasm:dist copies pre-built src→dist (no Rust/Emscripten needed)
- jszip/node-forge/fflate pre-bundled for CJS→ESM conversion

Tests:
- 163 vitest tests (happy-dom): all lib, components, App integration,
  WASM dist artifact checks, libcurl Apple connectivity, anisette init
  error handling

Cleanup:
- Delete yarn.lock (bun.lock canonical), expand .gitignore
- Remove README.zh.md, rewrite README.md + AGENTS.md
- Update libcurl.js submodule to f65d440 (CI build artifacts)

README.md

@@ -1,13 +1,59 @@
 # Sideload.js
 
-A pure frontend signing infrastructure. 
+Browser-based IPA signing and installation. Pair an iOS device over WebUSB, sign with your Apple Developer account, and install — all from a single web page.
 
-## Install
+## Quick Start
 
+```bash
+bun install --ignore-scripts
+bun run dev
+```
 
-<!-- TODO: deploy to cf flow -->
-Deploy to Cloudflare worker.
+Open `http://localhost:5173`.
 
-## Technology
+## Project Structure
 
-1. when signing
+| Path | Purpose |
+|---|---|
+| `frontend/` | React + Tailwind SPA (Vite) |
+| `backend/` | Cloudflare Workers relay |
+| `dependencies/webmuxd/` | WebUSB usbmux/lockdown protocol library |
+| `wasm/openssl/` | OpenSSL WASM (TLS + pair record generation) |
+| `wasm/libcurl-wasm/` | libcurl WASM (Apple API HTTP via WISP proxy) |
+| `wasm/zsign-wasm/` | zsign WASM (IPA re-signing) |
+| `scripts/` | WASM native build scripts (Rust + Emscripten) |
+
+## Build
+
+```bash
+# WASM dist bundles (copies pre-built src→dist, no compiler needed)
+bun run build:wasm:dist
+
+# Frontend production build (runs wasm:dist automatically)
+bun run build:frontend
+
+# Full WASM recompile from source (requires Rust, Emscripten, precompiled OpenSSL)
+bun run build:wasm
+```
+
+## Docker
+
+```bash
+bun run build:wasm:dist   # ensure WASM dists exist
+docker build -t sideload-web .
+docker run -p 3000:3000 sideload-web
+```
+
+## Test
+
+```bash
+bun run test            # webmuxd unit tests
+bun run test:frontend   # frontend vitest suite (141 tests)
+```
+
+## Credits
+
+- [libimobiledevice](https://github.com/libimobiledevice/libimobiledevice)
+- [webmuxd](https://github.com/hack-different/webmuxd)
+- [zsign](https://github.com/nicehash/zsign)
+- [openssl-wasm](https://github.com/nicehash/openssl-wasm)