chore: vendor @joan/procedural-glyph-engine for portable builds

Move @joan/procedural-glyph-engine from absolute path dep
(/private/tmp/orby-pkg) to vendored local dep (web/vendor/) so the
SPA builds in Docker and on other machines without the temp dir.

- Vendor Orby v5.0.0 into web/vendor/
- Switch package.json dep to file:../vendor
- Update Dockerfile to COPY vendor into build context
- Use npm install instead of npm ci (file: deps need install)
- Fix missing trailing newline in Dockerfile

web/vendor/examples/README.md

@@ -0,0 +1,18 @@
+# Orby runnable examples
+
+Serve the extracted download folder over HTTP, then open one of these files:
+
+- `canvas.html` mounts the native canvas engine and invokes semantic states.
+- `web-component.html` uses the browser-native `<joan-glyph>` element.
+- `state-sequence.html` runs, pauses, resumes, and restarts a timed sequence.
+
+For example:
+
+```sh
+python3 -m http.server 4173
+```
+
+Then visit `http://127.0.0.1:4173/examples/canvas.html`.
+
+Every import is relative to the files included in the kit. No package registry,
+bundler, framework, or third-party dependency is required.