build(web): generate the UI's Tailwind CSS with the pinned standalone CLI (#685)

Replaces the hand-written Tailwind subset in app.css with a real, purged
Tailwind build: scripts/build_css.py runs the pinned, SHA-256-checked
standalone Tailwind CLI (no Node), the generated tailwind.css and
plugin-frame.css are committed, and CI fails when they are stale. The Pi
never builds anything. The login page (#683) now links tailwind.css too,
and the load-order test covers every template that links app.css.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/web_interface/test_gzip_fallback.py

@@ -28,6 +28,7 @@ def client(monkeypatch):
 @pytest.mark.parametrize("url,path", [
     ("/static/v3/plugins_manager.js", "v3/plugins_manager.js"),
     ("/static/v3/app.css", "v3/app.css"),
+    ("/static/v3/tailwind.css", "v3/tailwind.css"),
 ])
 def test_static_text_asset_is_gzipped_and_round_trips(client, url, path):
     resp = client.get(url, headers={"Accept-Encoding": "gzip, deflate"})