Switch to datastar-pro and stop tracking downloaded libs

Datastar-pro is fetched from a private Gitea repo (ryan/vendor-libs)
using VENDOR_TOKEN for CI/Docker builds, with a local fallback from
../optional/ for development. DaisyUI is pinned to v5.5.19 instead of
tracking latest. Downloaded files are now gitignored and fetched at
build time via 'task download', which is a dependency of both build
and live tasks.

Taskfile.yml

@@ -2,9 +2,12 @@ version: "3"
 
 tasks:
   download:
-    desc: Download latest client-side libs
+    desc: Download pinned client-side libs
     cmds:
       - go run cmd/downloader/main.go
+    status:
+      - test -f assets/js/datastar/datastar.js
+      - test -f assets/css/daisyui/daisyui.js
 
   build:templ:
     desc: Compile .templ files to Go
@@ -31,6 +34,7 @@ tasks:
     cmds:
       - go build -o bin/games .
     deps:
+      - download
       - build:templ
       - build:styles
 
@@ -58,6 +62,7 @@ tasks:
   live:
     desc: Dev mode with hot-reload
     deps:
+      - download
       - live:templ
       - live:styles
       - live:server