fix(build): compiled binary missing @modelcontextprotocol/sdk modules

shadcn (web devDependency) pulled a second peer copy of
@modelcontextprotocol/[email protected].1 (zod@3), so the server's zod@4 copy
lived in the npm cache as sdk/1.30.1_1. `deno compile --exclude-unused-npm`
embeds that _1 folder but the pruned snapshot resolves it as sdk/1.30.1,
so every SDK import failed at startup with ERR_MODULE_NOT_FOUND.

- drop the shadcn CLI dependency; vendor its tailwind.css (the only
  runtime use) as apps/web/app/shadcn-tailwind.css, removing the duplicate
- scripts/check-compiled-binary.sh: run the compiled binary with an empty
  env and `--role preflight`; it must load the full module graph and exit 2
  on config validation. Wired into `deno task ci` (check:binary) and the
  Dockerfile build stage.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/check-compiled-binary.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# 编译产物自检(deno task ci 的最后一步):deno compile 的 --exclude-unused-npm 可能漏嵌 npm 包/子路径,
+# 开发态与测试全绿但二进制启动即 ERR_MODULE_NOT_FOUND。这里用空环境跑 `--role preflight`:
+# 它会先加载完整的服务端模块图(db/任务引擎/全部模块),然后才因缺配置以退出码 2 结束;
+# 模块缺失会以退出码 1 + ERR_MODULE_NOT_FOUND 结束。
+set -u
+bin="${1:-dist/umt-server}"
+case "$bin" in /*) ;; *) bin="$PWD/$bin" ;; esac
+[ -x "$bin" ] || { echo "check-compiled-binary: 找不到编译产物 $bin(先跑 deno task build)" >&2; exit 1; }
+out=$(cd /tmp && env -i PATH="$PATH" "$bin" --role preflight 2>&1)
+code=$?
+if [ "$code" -eq 2 ] && printf '%s' "$out" | grep -q '配置无效'; then
+  echo "check-compiled-binary: ok(模块图加载完整)"
+  exit 0
+fi
+echo "check-compiled-binary: 编译产物自检失败(退出码 $code):" >&2
+printf '%s\n' "$out" >&2
+exit 1