fix: build CSS with Hugo's native TailwindCSS instead of PostCSS

hugo server/build was failing with "binary postcss is not a Node.js
script" — pnpm's default node_modules/.bin shims are shell wrappers, not
plain Node scripts, which Hugo's exec-security check rejects. Switches
head.html from css.PostCSS to css.TailwindCSS, drops the now-unused
PostCSS toolchain, and adds pnpm-workspace.yaml's
preferSymlinkedExecutables so pnpm emits real symlinks Hugo can exec
(same fix already in use on roux).

Also updates the Dockerfile's build stage to hugomods/hugo:debian-node,
which bundles the matching Hugo Extended + Node versions, keeping ffmpeg
for the video-compression step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012E2mmywuZyXmPBgSDtNdTL

package.json

@@ -9,10 +9,7 @@
     "format:check": "prettier --check \"layouts/**/*.html\" \"assets/**/*.css\" \"assets/**/*.js\" \"content/**/*.md\" \"*.toml\""
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4.0.0",
-    "autoprefixer": "^10.4.0",
-    "postcss": "^8.5.0",
-    "postcss-cli": "^11.0.0",
+    "@tailwindcss/cli": "^4.0.0",
     "prettier": "^3.8.3",
     "prettier-plugin-go-template": "^0.0.15",
     "prettier-plugin-toml": "^2.0.6",