R3: split the landing into its own static container

- gateway/Dockerfile gains a `landing` target: caddy:2-alpine + the shared
  Vite build (identical build args keep the ui stage a single cached build);
  the gateway target drops landing.html from the embed.
- The contour caddy routes /app/, /telegram/ and the Connect path to the
  gateway; the catch-all — the landing at / and any stray path — goes to the
  new landing service, so junk traffic is absorbed by static file serving.
- deploy/landing/Caddyfile mirrors the webui caching (immutable assets,
  no-cache shells) and falls back unknown paths to the landing shell.
- The gateway's / now 308-redirects to /app/ (keeps a local no-caddy run
  usable); webui placeholder landing.html removed.
- CI deploy probe checks both / (landing) and /app/ (gateway).

Verified: both images build; the landing container serves landing.html at /
(no-cache) with junk-path fallback; the gateway image redirects / to /app/
and carries no landing content.

gateway/internal/webui/webui_test.go

@@ -22,20 +22,12 @@ func body(t *testing.T, resp *http.Response) string {
 	return string(b)
 }
 
-// TestLandingMountServesLandingAndFallsBack: "/" serves the landing shell (no-cache) and
-// any unknown path falls back to it.
-func TestLandingMountServesLandingAndFallsBack(t *testing.T) {
-	h := Handler("", "landing.html")
-
-	resp := get(t, h, "/")
-	if resp.StatusCode != http.StatusOK || !strings.Contains(body(t, resp), "scrabble-landing") {
-		t.Fatalf("GET / did not serve the landing shell (status %d)", resp.StatusCode)
-	}
-	if cc := get(t, h, "/").Header.Get("Cache-Control"); cc != "no-cache" {
-		t.Errorf("landing Cache-Control = %q, want no-cache", cc)
-	}
-	if resp := get(t, h, "/whatever"); resp.StatusCode != http.StatusOK {
-		t.Fatalf("GET /whatever status = %d, want 200 (fallback)", resp.StatusCode)
+// TestShellNoCache: the served HTML shell carries no-cache so a new deploy's
+// shell (and the asset URLs it references) is fetched fresh.
+func TestShellNoCache(t *testing.T) {
+	h := Handler("/app/", "index.html")
+	if cc := get(t, h, "/app/").Header.Get("Cache-Control"); cc != "no-cache" {
+		t.Errorf("shell Cache-Control = %q, want no-cache", cc)
 	}
 }