R3: split the landing into its own static container

- gateway/Dockerfile gains a `landing` target: caddy:2-alpine + the shared
  Vite build (identical build args keep the ui stage a single cached build);
  the gateway target drops landing.html from the embed.
- The contour caddy routes /app/, /telegram/ and the Connect path to the
  gateway; the catch-all — the landing at / and any stray path — goes to the
  new landing service, so junk traffic is absorbed by static file serving.
- deploy/landing/Caddyfile mirrors the webui caching (immutable assets,
  no-cache shells) and falls back unknown paths to the landing shell.
- The gateway's / now 308-redirects to /app/ (keeps a local no-caddy run
  usable); webui placeholder landing.html removed.
- CI deploy probe checks both / (landing) and /app/ (gateway).

Verified: both images build; the landing container serves landing.html at /
(no-cache) with junk-path fallback; the gateway image redirects / to /app/
and carries no landing content.

.gitea/workflows/ci.yaml

@@ -298,17 +298,21 @@ jobs:
           # pick up the fresh config.
           docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana
 
-      - name: Probe the gateway through caddy
+      - name: Probe the landing and the gateway through caddy
         run: |
           set -u
+          # Two probes through the contour caddy (R3 split): "/" is the static
+          # landing container, "/app/" is the gateway-served SPA shell.
           for i in $(seq 1 20); do
-            if docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/; then
-              echo "healthy: GET http://scrabble/"
+            if docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/ &&
+               docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/app/; then
+              echo "healthy: GET http://scrabble/ (landing) + /app/ (gateway)"
               exit 0
             fi
             sleep 3
           done
-          echo "probe failed; recent gateway logs:"
+          echo "probe failed; recent landing + gateway logs:"
+          docker logs --tail 50 scrabble-landing || true
           docker logs --tail 50 scrabble-gateway || true
           exit 1