build: pre-deploy HTML inline-script syntax guard

A missing brace in a home.html inline <script> caused an app-wide login
outage (the whole block failed to parse, so boot never ran). Nothing in the
deploy path checked HTML syntax. Add tools/check-syntax.js: parses (never
runs) every inline <script> in server/public/*.html with vm and exits non-zero
on any syntax error, reporting the file + line.

Wired in two places:
- Dockerfile RUN after COPY server/ ./ — a syntax error now FAILS the build,
  so it can't deploy.
- redeploy.sh pre-flight — fast local feedback before triggering the remote
  build.

Verified: passes on current pages (16 blocks / 9 files); fails with the exact
location when a brace is removed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

redeploy.sh

@@ -39,5 +39,14 @@ if [ -z "$PW" ]; then
   read -rsp "Server password for $USER@$HOST: " PW; echo
 fi
 
+# Pre-flight: catch inline-<script> syntax errors in the served HTML BEFORE triggering a remote build (fast
+# local feedback — the Docker build runs the same check authoritatively and would fail anyway). A syntax error
+# in a big inline script breaks the whole page (it once caused an app-wide login outage). Skipped if node isn't
+# on PATH. Checks the local tree, which matches origin/master once you've pushed.
+if command -v node >/dev/null 2>&1; then
+  echo "==> Checking HTML inline-script syntax …"
+  node "$DIR/server/tools/check-syntax.js" || { echo "ERROR: HTML syntax check failed — fix before deploying (the build would fail too)."; exit 1; }
+fi
+
 echo "==> Triggering deploy on $USER@$HOST ($APPDIR) …"
 exec "$PLINK" -ssh -batch -hostkey "$HOSTKEY" -P "$PORT" -pw "$PW" "$USER@$HOST" "cd $APPDIR && bash deploy.sh $*"