Switch to datastar-pro and stop tracking downloaded libs

Datastar-pro is fetched from a private Gitea repo (ryan/vendor-libs)
using VENDOR_TOKEN for CI/Docker builds, with a local fallback from
../optional/ for development. DaisyUI is pinned to v5.5.19 instead of
tracking latest. Downloaded files are now gitignored and fetched at
build time via 'task download', which is a dependency of both build
and live tasks.

docker-compose.yml

@@ -5,6 +5,8 @@ services:
       args:
         VERSION: ${VERSION:-dev}
         COMMIT: ${COMMIT:-unknown}
+      secrets:
+        - vendor_token
     container_name: games
     restart: unless-stopped
     ports:
@@ -16,3 +18,7 @@ services:
       - PORT=8080
     volumes:
       - ./data:/data
+
+secrets:
+  vendor_token:
+    environment: VENDOR_TOKEN