feat(docker-watcher): phase 11 - frontend embed & SSE

Embed SvelteKit static build in Go binary via go:embed. Event bus
for pub/sub with deploy log, instance status, and deploy status events.
SSE endpoints for real-time streaming. Frontend SSE client with
exponential backoff reconnection. Makefile for build pipeline.
Update Phase 12 auth plan with OAuth2/OIDC support.

PLAN.md

@@ -284,8 +284,8 @@ Full dashboard for visibility, manual control, and configuration.
 19. **Quick Deploy page** — paste image URL, auto-inspect, pre-fill form, one-click deploy
 20. **Settings pages** — registries, credentials, global settings, webhook URL management
 21. **Project config pages** — add/edit/delete projects and stages via UI
-22. **Embed in Go** — build SvelteKit to static, embed with `go:embed`, serve from Go
-23. **Real-time updates** — SSE for deploy progress and instance status changes
+22. **Embed in Go** ✅ — build SvelteKit to static, embed with `go:embed`, serve from Go
+23. **Real-time updates** ✅ — SSE for deploy progress and instance status changes
 
 ### Phase 4: Volumes & Environment
 
@@ -329,7 +329,9 @@ stages:
 
 30. **Blue-green deploys** — start new, health check, swap, stop old (zero downtime)
 31. **Promote flow** — enforce `promote_from` for production deploys
-32. **Auth on dashboard** — basic auth or token-based
+32. **Auth on dashboard** — two modes, configurable via settings:
+    - **Local auth** — username/password stored in SQLite (hashed), for simple setups
+    - **OAuth2 / OpenID Connect** — integration with Authentik (or any OIDC provider), configurable client ID/secret/discovery URL
 33. **Graceful shutdown** — drain in-progress deploys on SIGTERM
 34. **Structured logging** — JSON logs with deploy context
 35. **Config export** — download current SQLite state as YAML