feat(deploy): M11 单二进制装配（cmd/cyrene 全链路 wire + go:embed 前端 + 外置 dist 覆盖 + 优雅关闭 + SPA 静态服务）；前端 build 拷到 internal/webui/dist

internal/services/gateway/server.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/fs"
 	"log/slog"
 	"net"
 	"net/http"
@@ -116,6 +117,10 @@ type Deps struct {
 	Memories MemoryStore
 	// IoT lists IoT devices. Optional.
 	IoT IoTStore
+	// Frontend is the SPA filesystem served for all non-API, non-WS routes.
+	// When nil the gateway serves no static assets (API and WS only). The
+	// embedded dist (internal/webui) or an external dist directory is used.
+	Frontend fs.FS
 }
 
 // Server is the gateway. It owns a ServeMux aggregating REST + WS + admin and a
@@ -130,6 +135,7 @@ type Server struct {
 	personas PersonaStore
 	memories MemoryStore
 	iot      IoTStore
+	frontend fs.FS
 	log      *slog.Logger
 	hub      *hub
 }
@@ -154,6 +160,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		personas: deps.Personas,
 		memories: deps.Memories,
 		iot:      deps.IoT,
+		frontend: deps.Frontend,
 		log:      sourcedLog(deps.Log),
 	}
 	s.hub = newHub(s)
@@ -191,6 +198,9 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/v1/admin/plugins/policy", s.auth.Authorize(auth.RoleOwner)(http.HandlerFunc(s.adminSetPolicy)))
 
 	var h http.Handler = mux
+	if s.frontend != nil {
+		h = s.spa(h)
+	}
 	h = s.recover(h)
 	h = s.cors(h)
 	h = s.logging(h)