Rework onsite admin interface

[Syfaro]

This is a complete reimplementation of the frontend of the onsite admin UI. It makes the page more interactive and responsive, while also making it easier to add future features. All of the original (working) functionality and keyboard shortcuts have been reimplemented, in addition to many new features.

It introduces esbuild for compiling and bundling TypeScript and SASS, which might also be useful for future user-facing UI enhancements.

As part of these frontend enhancements, a number of other changes were introduced. These include:

• Updating attendee search to be more functional. Instead of only matching a single field at a time, it uses trigram similarity to match on entire first and last names, in addition to badge names. It also now includes badge number.
• Adding a new configuration option, PRINT_VIA_MQTT which publishes to the MQTT action topic for the terminal allowing software running on the local machine to process the print request without having to interact with a system print dialog. This is compatible with reg-interface.

This is a pretty substantial change, and I understand if not everything here is desired.

(Moved from forked branch in #335)

[rechner]

Last step to make this deployable, we need to rebuild the base docker image to include the new python dependency. You'll need to have a Github CR PAT with write:packages scope, then set GITHUB_USER and GITHUB_CR_PAT environment variables (e.g. in .envrc).

make docker-login
make build-base-docker-image

It should modify the Dockerfile to point to the new base image, push and commit that.

[rechner]

Looks beautiful. There's a few problems this is running into on staging around content security policies, see this glitchtip, I think we have those set relatively strictly for staging/production, though I'm surprised this hasn't come up before since the old interface also ends up using an MQTT websocket connection.

Also seeing this in the console for the MQTT library:
mqtt.esm.js:2 Refused to create a worker from 'blob:https://staging.furthemore.org/74fecfed-4196-4ee9-b99e-4448c2bcfaa2' because it violates the following Content Security Policy directive: "default-src https: 'unsafe-eval' 'unsafe-inline'". Note that 'worker-src' was not explicitly set, so 'default-src' is used as a fallback.

Do you know what we might be missing here?