RFC 0001-P4: Server image + service container integration

Phase 4: produce a `fleetd --mode=server` image that runs cleanly on SKI service container infrastructure, plus the build-tag gate so the agent binary doesn't drag along the React SPA.

## Acceptance criteria

- `server/Dockerfile.server` builds `fleetd --mode=server` with no plugin binaries copied in.
- Read-only rootfs compatible: any current writes to the local filesystem either go to `/tmp` (ephemeral emptyDir) or are eliminated.
- Block Go service container framework hooks: `/_status` endpoint, structured logging, metrics, S2S identity, config conventions matching other Block SKI services.
- Connect-RPC traffic exposed via Envoy / S2S as expected for SKI services (auth, mTLS, etc., per Block convention).
- React UI gated by `//go:build !agent` so the agent binary doesn't embed the SPA.
- Image scans clean against Block's standard container security checks (no high-CVE base, etc.).

## Reference

RFC 0001 Phase 4: https://github.com/block/proto-fleet/pull/145

Start with RFC 0001 Phase 4 and inspect server/Dockerfile.server, the fleetd server-mode entry point, and the build-tagged React integration. Compare the service-container hooks, filesystem writes, Connect-RPC exposure, and image-scan requirements with other Block SKI services; done means all listed acceptance criteria pass.

Written by the indexing model from the issue text.