Recreate the embed directory so stale dotfiles cannot be served

Review finding F1: the cleanup glob internal/frontend/dist/* skipped
hidden files, which all:dist embeds. Remove and recreate the whole
directory before copying web/dist, and add a check-embed-clean target
that plants a stale hidden file and asserts the embed removes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -2,7 +2,7 @@
 
 FRONTEND_DIST := internal/frontend/dist
 
-.PHONY: build web embed
+.PHONY: build web embed check-embed-clean
 
 build: embed
 	go build -o bin/mealquest ./cmd/server
@@ -11,6 +11,14 @@ web:
 	cd web && npm ci && npm run build
 
 # Replace the committed placeholder with the built PWA so go:embed picks it up.
+# Recreate the whole directory: a glob would skip dotfiles, which all:dist embeds.
 embed: web
-	rm -rf $(FRONTEND_DIST)/*
+	rm -rf $(FRONTEND_DIST)
+	mkdir -p $(FRONTEND_DIST)
 	cp -R web/dist/. $(FRONTEND_DIST)/
+
+# Regression check: a stale hidden file must not survive an embed.
+check-embed-clean:
+	touch $(FRONTEND_DIST)/.stale-embed-check
+	$(MAKE) embed
+	test ! -e $(FRONTEND_DIST)/.stale-embed-check