Adds pin.yaml/pin.lock and the vendored diff2html bundle. Templates not
yet updated to reference /static/vendor/, and tailwind still served from
the manually-copied static/tailwind.js (blocked on git-pkgs/pin#2).
Anchors .gitignore vendor/ rule to repo root so it stops matching
internal/server/static/vendor/.
