feat(webid): split bootstrap and installer routes

Production has two separate flows:
1. /{pkg} (curl-pipe bootstrap) — minimal script that sets WEBI_PKG,
   WEBI_HOST, WEBI_CHECKSUM and downloads+runs webi
2. /api/installers/{pkg}.sh — full installer with resolved release
   and embedded install.sh

Previously handleBootstrap served the full installer. Now:
- handleBootstrap: curl-pipe bootstrap (reads curl-pipe-bootstrap.tpl.sh)
- handleInstaller: full installer (/api/installers/{pkg}.sh)

Also:
- Export render.InjectVar for use by bootstrap handler
- Add webi.sh checksum calculation (SHA-1 first 8 chars)
- Add /api/installers/ route to mux and test server

internal/render/render.go

@@ -123,7 +123,7 @@ func Bash(tplPath, installersDir, pkgName string, p Params) (string, error) {
 	}
 
 	for _, v := range vars {
-		text = injectVar(text, v.name, v.value)
+		text = InjectVar(text, v.name, v.value)
 	}
 
 	// Inject the installer script at the {{ installer }} marker.
@@ -151,8 +151,15 @@ func getVarPattern(name string) *regexp.Regexp {
 	return p
 }
 
-// injectVar replaces a template variable line with its value.
-func injectVar(text, name, value string) string {
+// InjectVar replaces a template variable line with its value.
+// It matches lines like:
+//
+//	#WEBI_VERSION=
+//	#export WEBI_PKG_URL=
+//	export WEBI_HOST=
+//
+// and replaces them with the value in single quotes.
+func InjectVar(text, name, value string) string {
 	p := getVarPattern(name)
 	return p.ReplaceAllString(text, "${1}${3}"+name+"='"+sanitizeShellValue(value)+"'")
 }

internal/render/render_test.go

@@ -45,7 +45,7 @@ func TestInjectVar(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := injectVar(tt.input, tt.key, tt.value)
+			got := InjectVar(tt.input, tt.key, tt.value)
 			if strings.TrimSpace(got) != strings.TrimSpace(tt.want) {
 				t.Errorf("got  %q\nwant %q", got, tt.want)
 			}
@@ -65,11 +65,11 @@ __bootstrap_webi() {
 `
 
 	result := tpl
-	result = injectVar(result, "PKG_NAME", "bat")
-	result = injectVar(result, "WEBI_OS", "linux")
-	result = injectVar(result, "WEBI_ARCH", "x86_64")
-	result = injectVar(result, "WEBI_VERSION", "0.26.1")
-	result = injectVar(result, "WEBI_HOST", "https://webinstall.dev")
+	result = InjectVar(result, "PKG_NAME", "bat")
+	result = InjectVar(result, "WEBI_OS", "linux")
+	result = InjectVar(result, "WEBI_ARCH", "x86_64")
+	result = InjectVar(result, "WEBI_VERSION", "0.26.1")
+	result = InjectVar(result, "WEBI_HOST", "https://webinstall.dev")
 
 	if !strings.Contains(result, "PKG_NAME='bat'") {
 		t.Error("PKG_NAME not injected")