chore: vendor @joan/procedural-glyph-engine for portable builds

Move @joan/procedural-glyph-engine from absolute path dep
(/private/tmp/orby-pkg) to vendored local dep (web/vendor/) so the
SPA builds in Docker and on other machines without the temp dir.

- Vendor Orby v5.0.0 into web/vendor/
- Switch package.json dep to file:../vendor
- Update Dockerfile to COPY vendor into build context
- Use npm install instead of npm ci (file: deps need install)
- Fix missing trailing newline in Dockerfile

web/vendor/manifest.json

@@ -0,0 +1,11 @@
+{
+  "name": "@joan/procedural-glyph-engine",
+  "version": "5.0.0",
+  "license": "SEE LICENSE IN LICENSE",
+  "entry": "./src/joan-engine.js",
+  "demo": "./index.html",
+  "assets": [
+    "./src/styles.css"
+  ],
+  "format": "esm"
+}