Vite migration (1/3): Go HTML and asset contract #1579

Part of #1578. First step of the series; can land while Create React App still builds.

Problem. internal/controller/template_controller.go GetStyle() scrapes the script and stylesheet paths out of the built ui/build/index.html with regexes that require classic scripts with defer first and stylesheet links with href before rel, and it returns a single stylesheet path. Every server-rendered page reuses those paths through ui/template/header.html. Any other tag shape returns nothing, and the pages load with no JavaScript and no stylesheet while every build step still reports success. Nothing in the tree asserts the contract.

Change. Read the tags from the parsed document (golang.org/x/net/html), so attribute order, attribute set and quoting no longer matter. Return cssPath as a list, mirroring how script paths are already collected and prefixed, and range over it in header.html. Add TestGetStyleResolvesBuiltAssets, which calls the real GetStyle() against the real embedded build and skips when no build is embedded. Keep the classic <script defer="defer" src=...> tag in header.html; the module switch belongs to step 2.

Done when. dev with only this change builds the frontend with the current toolchain, go build ./... and go vet ./... pass, the test passes against that build, and the served pages are unchanged (one stylesheet, classic scripts).