Switch to datastar-pro and stop tracking downloaded libs

Datastar-pro is fetched from a private Gitea repo (ryan/vendor-libs)
using VENDOR_TOKEN for CI/Docker builds, with a local fallback from
../optional/ for development. DaisyUI is pinned to v5.5.19 instead of
tracking latest. Downloaded files are now gitignored and fetched at
build time via 'task download', which is a dependency of both build
and live tasks.

Dockerfile

@@ -10,6 +10,11 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
+
+RUN --mount=type=secret,id=vendor_token \
+    VENDOR_TOKEN=$(cat /run/secrets/vendor_token) \
+    go run cmd/downloader/main.go
+
 RUN go tool templ generate
 RUN go tool gotailwind -i assets/css/input.css -o assets/css/output.css --minify
 RUN --mount=type=cache,target=/root/.cache/go-build \