Factor webapp-specific stuff (and keepalive) out of boot.js into webapp package.

Replace type: "bare" with type: "server" in attributes.json.  This now just
means "only make one server process" rather than controlling the boot script.

Programs that are type: "traditional" that want to be a webapp now need to
explicitly depend on the webapp package.