build(web): generate the UI's Tailwind CSS with the pinned standalone CLI (#685)

Replaces the hand-written Tailwind subset in app.css with a real, purged
Tailwind build: scripts/build_css.py runs the pinned, SHA-256-checked
standalone Tailwind CLI (no Node), the generated tailwind.css and
plugin-frame.css are committed, and CI fails when they are stale. The Pi
never builds anything. The login page (#683) now links tailwind.css too,
and the load-order test covers every template that links app.css.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web_interface/blueprints/pages_v3.py

@@ -301,10 +301,12 @@ def serve_plugin_web_ui(plugin_id, filename):
             # but we also Unicode-escape HTML meta-chars as defence in depth.
             f'  window.PLUGIN_ID = {safe_plugin_id_js};\n'
             '</script>\n'
-            # Tailwind v2 CDN — same version used by the parent LEDMatrix UI
-            '<link rel="stylesheet" '
-            'href="https://cdnjs.cloudflare.com/ajax/libs/tailwindcss/2.2.19/tailwind.min.css" '
-            'crossorigin="anonymous">\n'
+            # Served locally (not from a CDN) so fragments are styled in AP
+            # mode with no internet. Built by scripts/build_css.py; see
+            # web_interface/tailwind/plugin-frame.config.js.
+            '<link rel="stylesheet" href="'
+            + url_for('static', filename='v3/plugin-frame.css')
+            + '">\n'
             '<style>body{margin:0;padding:0;background:#fff;}</style>\n'
             '</head>\n'
             '<body>\n'