chore: vendor @joan/procedural-glyph-engine for portable builds

Move @joan/procedural-glyph-engine from absolute path dep
(/private/tmp/orby-pkg) to vendored local dep (web/vendor/) so the
SPA builds in Docker and on other machines without the temp dir.

- Vendor Orby v5.0.0 into web/vendor/
- Switch package.json dep to file:../vendor
- Update Dockerfile to COPY vendor into build context
- Use npm install instead of npm ci (file: deps need install)
- Fix missing trailing newline in Dockerfile

web/vendor/NOTICE

@@ -0,0 +1,7 @@
+Orby
+Copyright 2026 Joan Sterjo
+
+This product includes software developed by Joan Sterjo.
+
+The Apache License 2.0 grant is subject to the Commons Clause License
+Condition v1.0. See LICENSE for the complete terms.