feat(03-04): Worker [assets] binding + one-command deploy + D-14 build-artifact gate

- wrangler.jsonc assets block serves ../web/dist; run_worker_first keeps /api/* + /telegram/* on the Worker (D-13)
- root npm run deploy = build theme → web → bot wrangler deploy + set-webhook (D-15); dev = build + wrangler dev --port 8787 --local (D-12)
- vite.config.ts dual-build: __ARAHARAH_HARNESS__ define keyed on --mode harness, separate dist/dist-harness outDirs
- main.ts guard unchanged; ambient constant declared once in web/src/vite-env.d.ts
- build-artifact.test.mjs BA1..BA6: zero CDN refs, self-hosted fonts, MapLibre worker, inlined style, no mock installer in ANY emitted file (HTML included)

.gitignore

@@ -7,9 +7,12 @@
 # Dependencies
 node_modules/
 
-# Build output
+# Build output (any depth covers theme/dist and web/dist — regenerated
+# output must NEVER be committed, including theme/dist which the web
+# build consumes at build time without vendoring)
 dist/
 theme/dist/
+web/dist-harness/
 
 # Secrets / local env
 .env