Harden embedded web UI serving: font filtering, pre-bootstrap middleware, SPA fallback

[BYK]

Description

The embedded web UI from #19299 works but has several production-facing gaps:

1. Binary size: All fonts (~27MB) are embedded, though users only use one monospace font at a time
2. DB migration on assets: Every asset request goes through Instance.provide(), triggering DB migration checks
3. No SPA routing: Page refreshes on client-side routes return 404 instead of index.html
4. No dev override: No way to point at a local packages/app/dist during development without compiling
5. No fallback: If an asset is missing from the embedded bundle, it's a hard 404 instead of falling back to CDN

Steps to reproduce

1. Build binary with embedded web UI
2. Navigate to a deep route like /session/abc and refresh → 404
3. Check binary size — ~27MB larger than necessary due to optional fonts
4. During dev, no way to serve local app build without full recompilation

OpenCode version

v1.3.3

OS

Linux

[thdxr]

good catches looking at these today

[BYK]

@thdxr note that I've also submitted a PR to fix this :)