chore: vendor @joan/procedural-glyph-engine for portable builds

Move @joan/procedural-glyph-engine from absolute path dep
(/private/tmp/orby-pkg) to vendored local dep (web/vendor/) so the
SPA builds in Docker and on other machines without the temp dir.

- Vendor Orby v5.0.0 into web/vendor/
- Switch package.json dep to file:../vendor
- Update Dockerfile to COPY vendor into build context
- Use npm install instead of npm ci (file: deps need install)
- Fix missing trailing newline in Dockerfile

web/package.json

@@ -42,7 +42,7 @@
     "vitest": "^2.0.0"
   },
   "dependencies": {
-    "@joan/procedural-glyph-engine": "file:../../../../../private/tmp/orby-pkg",
+    "@joan/procedural-glyph-engine": "file:../vendor",
     "@surdeddd/wmkit": "^0.3.0",
     "clsx": "^2.1.1",
     "d3-force": "^3.0.0",