refactor: migrate frontend to React + Tailwind, add Docker + tests

Replace the vanilla-TS innerHTML frontend with a type-checked React
component tree (React 19 + Tailwind v4 + Vite).

Frontend:
- 14 components: Header, Stepper, LoginPage, LoginModal, SignPage,
  DropZone, DevicePicker, ProgressCard, SavedAccountsList, TrustModal,
  TwoFactorModal, Button, Field, Chip, Modal
- lib/ extracts: storage (10 localStorage keys preserved), pair-record,
  account-session, log-parser, ids, use-log hook
- flows/ encapsulate async pair/login/sign/install with dependency injection
- Accounts page as main view with Add Account modal
- Fullscreen progress overlay during sign/install
- Account selector + device picker on Sign page
- Security notice in login modal (server trust warning)
- All addLog calls mirrored to console.log for devtools debugging

Build:
- bun run dev: submodule init + install + wasm dist + vite + wrangler
- bun run setup: one-shot project bootstrap
- Docker: multi-stage bun build → nginx on :3000
- build:wasm:dist copies pre-built src→dist (no Rust/Emscripten needed)
- jszip/node-forge/fflate pre-bundled for CJS→ESM conversion

Tests:
- 163 vitest tests (happy-dom): all lib, components, App integration,
  WASM dist artifact checks, libcurl Apple connectivity, anisette init
  error handling

Cleanup:
- Delete yarn.lock (bun.lock canonical), expand .gitignore
- Remove README.zh.md, rewrite README.md + AGENTS.md
- Update libcurl.js submodule to f65d440 (CI build artifacts)

frontend/src/test/wasm-dist.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Verify that all WASM dist bundles and their binary dependencies exist on
+ * disk. These are built by `bun run build:wasm:dist`.
+ *
+ * We test file existence (not dynamic import) because the modules pull in
+ * heavy WASM blobs and browser-only APIs that don't load in a test env.
+ */
+import { describe, expect, it } from 'vitest';
+import { access, realpath } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
+
+async function fileExists(relativePath: string): Promise<boolean> {
+  try {
+    await access(resolve(root, relativePath));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function symlinkResolves(relativePath: string): Promise<boolean> {
+  try {
+    await realpath(resolve(root, relativePath));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+describe('WASM dist artifacts', () => {
+  it('openssl dist/index.mjs exists', async () => {
+    expect(await fileExists('wasm/openssl/dist/index.mjs')).toBe(true);
+  });
+
+  it('openssl binary/openssl_wasm.js exists (via symlink to pkg)', async () => {
+    expect(await symlinkResolves('wasm/openssl/binary/openssl_wasm.js')).toBe(true);
+  });
+
+  it('openssl binary/openssl_wasm_bg.wasm exists', async () => {
+    expect(await symlinkResolves('wasm/openssl/binary/openssl_wasm_bg.wasm')).toBe(true);
+  });
+
+  it('libcurl dist/bundled.mjs exists', async () => {
+    expect(await fileExists('wasm/libcurl-wasm/dist/bundled.mjs')).toBe(true);
+  });
+
+  it('libcurl dist/index.mjs exists', async () => {
+    expect(await fileExists('wasm/libcurl-wasm/dist/index.mjs')).toBe(true);
+  });
+
+  it('libcurl binary/libcurl_full.mjs resolves', async () => {
+    expect(await symlinkResolves('wasm/libcurl-wasm/binary/libcurl_full.mjs')).toBe(true);
+  });
+
+  it('libcurl binary/libcurl.mjs resolves', async () => {
+    expect(await symlinkResolves('wasm/libcurl-wasm/binary/libcurl.mjs')).toBe(true);
+  });
+
+  it('zsign js/dist/index.mjs exists', async () => {
+    expect(await fileExists('wasm/zsign-wasm/js/dist/index.mjs')).toBe(true);
+  });
+
+  it('zsign js/dist/browser.mjs exists', async () => {
+    expect(await fileExists('wasm/zsign-wasm/js/dist/browser.mjs')).toBe(true);
+  });
+});