fix(build): compiled binary missing @modelcontextprotocol/sdk modules

shadcn (web devDependency) pulled a second peer copy of
@modelcontextprotocol/[email protected].1 (zod@3), so the server's zod@4 copy
lived in the npm cache as sdk/1.30.1_1. `deno compile --exclude-unused-npm`
embeds that _1 folder but the pruned snapshot resolves it as sdk/1.30.1,
so every SDK import failed at startup with ERR_MODULE_NOT_FOUND.

- drop the shadcn CLI dependency; vendor its tailwind.css (the only
  runtime use) as apps/web/app/shadcn-tailwind.css, removing the duplicate
- scripts/check-compiled-binary.sh: run the compiled binary with an empty
  env and `--role preflight`; it must load the full module graph and exit 2
  on config validation. Wired into `deno task ci` (check:binary) and the
  Dockerfile build stage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Dockerfile

@@ -16,7 +16,8 @@ RUN deno task check:tokens && cd apps/web && deno task build
 # 权限在编译时固定:读写不限路径(库根/下载目录由用户挂载,位置不固定;写保护靠 /app root 只读 + 非 root 运行);
 # --allow-run 只放 ffprobe(入库探测)、sha256sum(强制全量哈希走子进程,coreutils 自带)与 /app/umt-server 自身
 # (fsproxy 把单个文件操作放进 `umt-server --role fsworker` 一次性子进程,挂死可 SIGKILL 回收;二进制必须装在 /app/umt-server)
-RUN cd apps/server && deno task compile
+# 编译后立即自检:空环境跑 --role preflight,模块图缺件(ERR_MODULE_NOT_FOUND)在构建期就失败,不留到容器启动
+RUN cd apps/server && deno task compile && cd /src && sh scripts/check-compiled-binary.sh
 
 FROM debian:trixie-slim
 # gosu:root 修完 DATA_DIR 属主后降权;postgresql-client:备份/恢复脚本用 pg_dump/pg_restore/psql