Railbase core v0.5.19

Internal refactor — no user-facing behaviour change.

• Unified UI kit. The admin and site SPAs now share one source of truth — the shadcn-on-Preact kit lives in a single ui/ workspace package instead of being duplicated (the site previously carried a byte-identical copy that drifted from admin). Same admin panel, same site shell, same /api/_ui registry bytes for downstream apps.
• One hoisted node_modules (npm workspace) → a single preact instance; the public site's utility CSS stays lean.

Verified: full go test ./..., make build, admin 185 unit tests, both SPAs render with zero console errors, /api/_ui + railbase ui init intact. Binaries pin the railbase.app vendor trust root — verify against checksums.txt.