0.28.1 — vendor @joan/procedural-glyph-engine for portable SPA builds (fixes deploy)

The procedural-glyph-engine dep pointed at a non-portable file:/private/tmp/orby-pkg
path, breaking npm ci in Docker and every main deploy since v0.20.0 (the build
cache masked it until it busted ~Aug 5). Vendor Orby v5.0.0 into web/vendor/,
switch the dep to file:../vendor, and use npm install in the web Dockerfile
(file: deps need install, not ci). Cherry-picked from 3cd4cf9.

web/package.json

@@ -42,7 +42,7 @@
     "vitest": "^2.0.0"
   },
   "dependencies": {
-    "@joan/procedural-glyph-engine": "file:../../../../../private/tmp/orby-pkg",
+    "@joan/procedural-glyph-engine": "file:../vendor",
     "@surdeddd/wmkit": "^0.3.0",
     "clsx": "^2.1.1",
     "d3-force": "^3.0.0",