Copy the fresh console bundle after the Docker build context

The source copy overwrote the generated index.html with a tracked stale version after the web stage had supplied fresh hashed assets. Browsers requested a missing script and received the SPA HTML fallback. Copy the web stage output last so the embedded entrypoint and assets come from the same build.

Dockerfile

@@ -34,18 +34,17 @@ ARG TARGETARCH=amd64
 
 WORKDIR /src
 
-# The real console bundle goes in *after* the source tree, so the COPY above
+# Download modules before copying the application sources.
-# (which carries only the .gitkeep placeholder from a fresh clone) cannot
-# clobber it. `all:dist` in the embed directive needs the directory itself to
-# exist, which the placeholder guarantees.
-COPY --from=web /src/internal/web/dist/ internal/web/dist/
-
-# Module cache first, for the same reason.
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
+# Copy the fresh bundle last: the source tree contains a tracked index.html
+# whose hashed asset references can be stale. It must never overwrite the
+# index generated alongside the JavaScript and CSS in the web stage.
+COPY --from=web /src/internal/web/dist/ internal/web/dist/
+
 # CGO off: the resolver, bbolt and the TLS stack are all pure Go, and a static
 # binary is what lets the runtime stage be distroless-static.
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \