Get rid of the facade export of card-web-app.js

[jkomoros]

Originally tracked in #589

Currently card-web-app.js in the build is a very simple "facade" export that then imports the "real" card-web-app import that uses the hash value in the URL. But this leads to an unnecessary extra round trip.

If we were able to set preserveEntrySignatures to false, and use the updated/final import name directly in index.html, then we'd get around this. rollup-plugin-html should do this, but for some reason it just completely skips the actual module import in the final output (does it not like script type=module?

Original from #589:

Use https://modern-web.dev/docs/building/rollup-plugin-html/ on the index.html directly

Why is there a no-op import from card-web-app.js to one with a nonce? Won't that lead to extra round-trips in production? That's a facade export because https://rollupjs.org/guide/en/#preserveentrysignatures is set to 'strict'. Being able to use rollup-plugin-html (which apparently skips type=module imports?) would allow this to be set to false.