Items-list sparklines, retro CSS, pinned tooling, deploy docs

- Bulk-load recent price points per item and render a sparkline in
  the items list (new LoadRecentPriceHistory query avoids N+1).
- Add retro.css visual layer and refreshed login/items/layout styling.
- Swap the logo from webp to avif.
- Pin htmx/Chart.js/Tailwind/templ versions in the Makefile with
  vendor / tools / update-deps targets; README documents the
  dependency-bump flow and the hardened systemd deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -1,18 +1,28 @@
 # Veola build.
 #
-# Requires the `templ` CLI (go install github.com/a-h/templ/cmd/templ@latest).
-# The Tailwind standalone CLI is fetched on demand into bin/ (gitignored) — no
-# node toolchain required. static/css/tailwind.css is a committed build
-# artifact so a plain `go build` deploy still has styles; run `make css`
-# (or `make build`) after touching templates or static/css/input.css.
+# Tool dependencies — the `*_VERSION` variables below are the single source of
+# truth for every non-Go thing Veola pulls in at build time. To upgrade one,
+# bump its version and run `make vendor` (vendored JS) or just `make css`
+# (Tailwind) on a clean `bin/` to refetch.
+#
+# Go module dependencies live in go.mod and are bumped via `make update-deps`.
 
 TAILWIND_VERSION := v3.4.17
-TAILWIND_BIN     := bin/tailwindcss
-# linux-x64 only; change the asset name for other platforms.
-TAILWIND_URL     := https://github.com/tailwindlabs/tailwindcss/releases/download/$(TAILWIND_VERSION)/tailwindcss-linux-x64
-TEMPL            := $(shell go env GOPATH)/bin/templ
+HTMX_VERSION     := 2.0.4
+CHARTJS_VERSION  := 4.4.6
+TEMPL_VERSION    := v0.3.1020
 
-.PHONY: all generate css build run test clean
+TAILWIND_BIN     := bin/tailwindcss
+# Override TAILWIND_URL for non-linux-x64 platforms — see README "Build-time
+# tools" for the matching asset names on the Tailwind releases page.
+TAILWIND_URL     ?= https://github.com/tailwindlabs/tailwindcss/releases/download/$(TAILWIND_VERSION)/tailwindcss-linux-x64
+
+HTMX_URL    := https://unpkg.com/htmx.org@$(HTMX_VERSION)/dist/htmx.min.js
+CHARTJS_URL := https://cdn.jsdelivr.net/npm/chart.js@$(CHARTJS_VERSION)/dist/chart.umd.min.js
+
+TEMPL := $(shell go env GOPATH)/bin/templ
+
+.PHONY: all generate css build run test clean tools vendor update-deps
 
 all: build
 
@@ -41,3 +51,32 @@ test:
 
 clean:
 	rm -f veola-bin
+
+# Install the pinned templ CLI into $(go env GOPATH)/bin. Pinning matters
+# because two contributors on different templ versions can produce
+# differently-formatted generated Go for the same .templ source.
+tools:
+	go install github.com/a-h/templ/cmd/templ@$(TEMPL_VERSION)
+
+# Re-fetch vendored third-party JS at the currently pinned versions,
+# overwriting whatever is on disk. Also clears bin/tailwindcss so the next
+# `make css` pulls the pinned Tailwind binary. Use after bumping any of
+# HTMX_VERSION / CHARTJS_VERSION / TAILWIND_VERSION.
+vendor:
+	curl -sL --fail $(HTMX_URL)    -o static/vendor/htmx.min.js
+	curl -sL --fail $(CHARTJS_URL) -o static/vendor/chart.umd.min.js
+	rm -f $(TAILWIND_BIN)
+	$(MAKE) $(TAILWIND_BIN)
+
+# Bump Go module dependencies to their newest compatible versions, then
+# print upstream-release URLs for the non-Go tools so you can decide
+# whether to bump those pins too. Does not modify the pinned versions.
+update-deps:
+	go get -u ./...
+	go mod tidy
+	@echo
+	@echo "Pinned tool versions (current → upstream releases):"
+	@printf "  Tailwind   %s  →  https://github.com/tailwindlabs/tailwindcss/releases/latest\n" "$(TAILWIND_VERSION)"
+	@printf "  htmx       %s     →  https://github.com/bigskysoftware/htmx/releases/latest\n"  "$(HTMX_VERSION)"
+	@printf "  Chart.js   %s     →  https://github.com/chartjs/Chart.js/releases/latest\n"      "$(CHARTJS_VERSION)"
+	@printf "  templ      %s →  https://github.com/a-h/templ/releases/latest\n"                 "$(TEMPL_VERSION)"