feat(03-04): Worker [assets] binding + one-command deploy + D-14 build-artifact gate

- wrangler.jsonc assets block serves ../web/dist; run_worker_first keeps /api/* + /telegram/* on the Worker (D-13)
- root npm run deploy = build theme → web → bot wrangler deploy + set-webhook (D-15); dev = build + wrangler dev --port 8787 --local (D-12)
- vite.config.ts dual-build: __ARAHARAH_HARNESS__ define keyed on --mode harness, separate dist/dist-harness outDirs
- main.ts guard unchanged; ambient constant declared once in web/src/vite-env.d.ts
- build-artifact.test.mjs BA1..BA6: zero CDN refs, self-hosted fonts, MapLibre worker, inlined style, no mock installer in ANY emitted file (HTML included)

bot/package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "test": "node test/runner.mjs",
     "typecheck": "tsc --noEmit",
-    "dev": "wrangler dev",
+    "dev": "wrangler dev --port 8787 --local",
     "deploy": "wrangler deploy && node scripts/set-webhook.mjs",
     "commands": "node scripts/register-commands.mjs"
   },

bot/wrangler.jsonc

@@ -6,5 +6,14 @@
   // workers_dev: serve on the <name>.<account>.workers.dev URL — the WEBHOOK_URL
   // target for this phase (Phase 3's custom route/domain may supersede)
   "workers_dev": true,
+  // Workers static assets binding (D-13, D-14): serves ../web/dist. The
+  // Worker fetch still owns /api/* and /telegram/* first via
+  // run_worker_first (a GLOB ARRAY, not a boolean).
+  "assets": {
+    "directory": "../web/dist",
+    "binding": "ASSETS",
+    "not_found_handling": "none"
+  },
+  "run_worker_first": ["/api/*", "/telegram/*"],
   "kv_namespaces": [{ "binding": "chat_sessions", "id": "59f58a54bc44483e89872b20a005a5eb" }]
 }