0.28.1 — vendor @joan/procedural-glyph-engine for portable SPA builds (fixes deploy)

The procedural-glyph-engine dep pointed at a non-portable file:/private/tmp/orby-pkg
path, breaking npm ci in Docker and every main deploy since v0.20.0 (the build
cache masked it until it busted ~Aug 5). Vendor Orby v5.0.0 into web/vendor/,
switch the dep to file:../vendor, and use npm install in the web Dockerfile
(file: deps need install, not ci). Cherry-picked from 3cd4cf9.

compose/web/Dockerfile

@@ -8,7 +8,8 @@ FROM node:22-alpine AS builder
 
 WORKDIR /build/web
 COPY web/package.json web/package-lock.json ./
-RUN npm ci
+COPY web/vendor /build/vendor
+RUN npm install --no-audit --no-fund
 COPY VERSION ./
 COPY web/ ./
 RUN npm run build