chore: vendor @joan/procedural-glyph-engine for portable builds

Move @joan/procedural-glyph-engine from absolute path dep
(/private/tmp/orby-pkg) to vendored local dep (web/vendor/) so the
SPA builds in Docker and on other machines without the temp dir.

- Vendor Orby v5.0.0 into web/vendor/
- Switch package.json dep to file:../vendor
- Update Dockerfile to COPY vendor into build context
- Use npm install instead of npm ci (file: deps need install)
- Fix missing trailing newline in Dockerfile

compose/web/Dockerfile

@@ -8,7 +8,8 @@ FROM node:22-alpine AS builder
 
 WORKDIR /build/web
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+COPY web/vendor /build/vendor
+RUN npm install --no-audit --no-fund
 COPY VERSION ./
 COPY web/ ./
 RUN npm run build