web: draw assets, pages, csrf and the middleware from ecore

Deletes this package's copies of five things the instance now shares.

assets replaces hashedCSSRe, hashedBundleRe, resolveCSSHref,
resolveBundleHref and the bare StripPrefix(FileServer) route. That route
was a fix and not only a dedupe: an http.FileServer answers a directory
with a listing, so /static/ published the whole inventory of the binary
— every vendored artefact and the hashed names that fingerprint the
build — as a public, hour-cacheable page. It also wrote the cache
directives onto the header map before delegating, where a panic later
would have carried public, max-age=3600 onto a viewer's error page, and
left the Vary the private-cache policy sets, which is enough to stop any
shared cache from ever reusing an asset whose name was hashed for that
purpose. assets.Handler refuses the listing, stamps the policy on the
bytes rather than on the map, and drops the Vary per asset.

pages replaces pageNames, the package-level template map, render and
errorData. Pages are discovered from the embedded tree instead of listed
by hand, so templates/x.html is now the whole registration of a page,
and a page that defines no content block is refused at startup rather
than served as chrome around a hole with a 200 — neither of which this
service checked before. Render answers the response itself; the error it
returns is a log line and never reaches fail.

The local error.html goes with them: ecore ships the page and the
srht-error partial. renderError stays here, because building this
service's view struct is this service's business, and it now passes
for every status but 400 so a repository the viewer may not see and one
that never existed produce the same sentence.

csrf.Require and the middleware group are new rather than replacements:
compare has no POST today, so the guard covers the day somebody adds
one, and PrivateCache states the policy every per-viewer page here was
serving without.

BundleHref leaves viewData for chrome.Service.Assets, keyed bundle.js
and read through an emptiness guard, next to StyleHref where the other
hashed artefact already lived. The date helper goes to chrome's reltime
and abstime: listings show 3 days ago and hover to the exact stamp.

web: http server, sourcehut chrome, compare/commit pages

Implement the compare.sr.ht HTTP layer over the committed core/gitx/authz
packages:

- Server assembly (New) from shared SourceHut config: [git.sr.ht] repos,
  [meta.sr.ht]/[compare.sr.ht] origins, [sr.ht] site-name/environment, and
  the hashed stylesheet resolved by globbing the embedded static FS.
- Routes: landing, repo page, compare (base..base...head, .patch escape
  hatch), single-commit (+.patch), embedded static assets, healthz. Compare
  form GET canonicalizes to a clean URL via 302.
- SourceHut chrome port to html/template: nav service switcher (canonical
  order, paste/pages/hub excluded, compare active), login/logout with
  return_to, environment banner.
- Embedded compare-data JSON (template.JS so html/template's script-context
  escaper leaves it verbatim; json.Marshal's HTML escaping blocks a
  </script> breakout) plus the vendored bundle.js scaffold.
- httptest coverage with a stub Authorizer and a real git-CLI fixture repo.

The cmd layer must wire, in order: RealIP, Recoverer, Logger,
config.Middleware(conf,"compare.sr.ht"), authz.Middleware.