feat: add web layer (internal/web) and wire it into main.go

Routing, html/template layout/content pattern, and the Pre-Publish
check flow: POST /pruefen runs extraction (Stufe 1) then rules.Evaluate
(Stufe 2) and renders the result as an htmx fragment. Nothing is
persisted yet — that's the next step (wiring internal/store in).

The needsClarification case is rendered explicitly as a request for
more information rather than "no findings", matching the core
principle. Every result carries the legal-advice disclaimer required by
CLAUDE.md's guardrails.

Server depends on a narrow Extractor interface rather than *extract.
Client directly, so tests inject a fake instead of calling the real API
— internal/web's test suite never touches the network. htmx is vendored
locally (internal/web/static/htmx.min.js) instead of loaded from a CDN,
keeping the UI usable without runtime internet access.

cmd/deklarix/main.go now wires all of this together: reads
ANTHROPIC_API_KEY (required) and RULES_DIR (default "rules"), builds
the extract client and loads the rule set, and serves web.Server instead
of the old inline health-only mux.

This exposed the same crash-loop risk fixed earlier for DATABASE_URL:
postinst's start guard only checked DATABASE_URL, so a fresh install
would now crash-loop on a missing ANTHROPIC_API_KEY instead. The guard
checks both. scripts/build.sh also now ships rules/*.yaml into the .deb
under /usr/share/deklarix/rules (not a conffile — rules are updated via
the release pipeline, never hand-edited on a server), and
deklarix.env.example points RULES_DIR there by default.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/templates/result.html

@@ -0,0 +1,27 @@
+{{define "result"}}
+{{if .NeedsClarification}}
+  <p class="rueckfrage">
+    Die Gegenleistung konnte nicht sicher bestimmt werden. Bitte Angaben
+    präzisieren (z. B. ob ein Produkt oder eine Zahlung im Zusammenhang mit
+    dem Beitrag stand) — es wurde bewusst keine Bewertung abgegeben.
+  </p>
+{{else if .Findings}}
+  <ul class="findings">
+    {{range .Findings}}
+    <li class="finding finding-{{.Severity}}">
+      <strong>{{.RuleID}} v{{.Version}}</strong> ({{.Severity}}) — {{.Title}}
+      <p>Korrektur: {{.Fix}}</p>
+      {{if .Sources}}
+      <p>Fundstellen: {{range $i, $s := .Sources}}{{if $i}}; {{end}}{{$s}}{{end}}</p>
+      {{end}}
+    </li>
+    {{end}}
+  </ul>
+{{else}}
+  <p class="keine-findings">Keine Kennzeichnungsrisiken nach aktuellem Regelwerk gefunden.</p>
+{{end}}
+<p class="disclaimer">
+  Diese Prüfung ist keine Rechtsberatung und ersetzt keine anwaltliche
+  Prüfung im Einzelfall.
+</p>
+{{end}}