fix: build CSS with Hugo's native TailwindCSS instead of PostCSS

hugo server/build was failing with "binary postcss is not a Node.js
script" — pnpm's default node_modules/.bin shims are shell wrappers, not
plain Node scripts, which Hugo's exec-security check rejects. Switches
head.html from css.PostCSS to css.TailwindCSS, drops the now-unused
PostCSS toolchain, and adds pnpm-workspace.yaml's
preferSymlinkedExecutables so pnpm emits real symlinks Hugo can exec
(same fix already in use on roux).

Also updates the Dockerfile's build stage to hugomods/hugo:debian-node,
which bundles the matching Hugo Extended + Node versions, keeping ffmpeg
for the video-compression step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012E2mmywuZyXmPBgSDtNdTL

layouts/partials/head.html

@@ -112,8 +112,8 @@
     href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=Barlow:ital,wght@0,300;0,400;0,500;0,600;1,400&family=Share+Tech+Mono&display=swap"
 /></noscript>
 
-<!-- CSS via Hugo Pipes + PostCSS + Tailwind v4 -->
-{{- $css := resources.Get "css/main.css" | css.PostCSS -}}
+<!-- CSS via Hugo Pipes + Tailwind v4 (native css.TailwindCSS, no PostCSS) -->
+{{- $css := resources.Get "css/main.css" | css.TailwindCSS -}}
 {{- if eq hugo.Environment "production" -}}
   {{- $css = $css | minify | fingerprint "sha256" -}}
 {{- end -}}