bug(ui): dashboard renders blank on fresh clone — web/build assets not in git but embedded at compile time

[ajianaz]

What

Fresh git clone + cargo build produces a binary whose dashboard is blank. Every SPA asset request returns index.html content, so no JS loads.

Root cause

• .gitignore keeps only web/build/index.html (placeholder); _app/ assets are not committed.
• crates/trapfalld/src/spa.rs embeds ../../web/build/ via rust-embed at compile time.
• The tracked index.html references hashed assets (e.g. start.1t4N1VIg.js) that were never committed, so Assets::get() misses and the fallback serves index.html for every /_app/** path.

Impact

• Anyone evaluating TrapFall from README sees a blank page on first run — "trust dies on first use".
• Blocks docs: README polish — value prop, demo GIF, feature comparison table #300 (README polish) and infra: Deploy live read-only demo instance #302 (demo instance).

Suggested fix

• Build web assets in CI before cargo build (release workflow), and/or commit a consistent prebuilt bundle.
• Add a guard: warn loudly (or fail) at startup/embed time when Assets::iter().count() is below a sane threshold (e.g. < 10 files).

Reproduced

2026-08-27, locally from develop @ f932d7d. Fixed locally by running npm run build in web/ before cargo build.