feat: add hosted page container and comments

[mcoder2014]

Hosted pages can now use an enhanced response-time container with fixed navigation, login state, an explicit browse/comment switch, and persistent discussions on pages, text, images, and modules. Anonymous public visitors remain in browse mode with no comment data, invisible pages return HTML 404, and interactive modules such as maps keep their original DOM and event handling.

The change adds comment threads and immutable events, replies plus resolve/reopen/reanchor actions, scoped browser CSRF, dedicated AK/SK scopes and Skill commands, stable HTML anchor conventions, and conservative cross-release relocation. Existing projects migrate to raw; newly created projects default to enhanced.

Migration order: apply domain/dal/migrations/20260916_web_comments.sql before deploying this binary.

Validation:

• A full HTTPS E2E passed on Pi with a dedicated database, storage root, config, and loopback ports. It covered owner-only access, real 404 behavior, anonymous public browsing with hidden comments, default browse mode, preserved map-like interactions, text/module comments, app AK/SK replies, resolve/reopen, stable anchors after an entry-file rename, and lost-anchor footer fallback.
• The packaged Skill was exercised against the Pi service for doctor, list, show, create, reply, resolve, and reopen operations.
• Affected Go service/API tests pass, including the comment lifecycle, raw-page conditional 304 compatibility, and the new webcomments package in CI's enumerated package set.
• 23 Node/Chromium container tests pass; frontend regression suite is 60/60, changed-file ESLint passes, and the production frontend builds.
• Skill CLI suite is 15/15. Backend build.sh produces an executable binary.
• All 5 Mermaid diagrams render, and the standalone HTML specification was visually checked.