feat: add profiles, public views, settings, and code quality fixes

Phase 3 — Profiles & Public Views:
- Public profile page (/u/{username}) with OG meta tags
- User settings page (display name, bio, visibility, default privacy)
- Avatar upload with image processing
- Password change from settings (verifies current password)
- Home page shows public fave feed for logged-in users
- Must-reset-password guard redirects to /reset-password
- Profile visibility: public (full) or limited (username only)

Code quality improvements from /simplify review:
- Fix signup request persistence bug (was silently discarding data)
- Fix health check to use configured listen address, not hardcoded :8080
- Add rate limiter cleanup goroutine (was leaking memory)
- Extract shared helpers: ClearSessionCookie, IsSecureRequest, scanTags,
  scanUserFrom (scanner interface), SignupRequestStore
- Replace hand-rolled joinPlaceholders with strings.Join
- Remove dead _method hidden field, redundant devMode field
- Simplify rate-limited route registration (remove double-mux)
- Log previously-swallowed errors (session delete, image delete)
- Stop leaking internal error messages to users in image upload

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handler/auth.go

@@ -241,7 +241,28 @@ func (h *Handler) handleResetPasswordPost(w http.ResponseWriter, r *http.Request
 }
 
 func (h *Handler) handleHome(w http.ResponseWriter, r *http.Request) {
-	h.deps.Renderer.Page(w, r, "home", render.PageData{})
+	user := middleware.UserFromContext(r.Context())
+
+	var data map[string]any
+	if user != nil {
+		page := queryInt(r, "page", 1)
+		offset := (page - 1) * defaultPageSize
+		faves, total, err := h.deps.Faves.ListPublic(defaultPageSize, offset)
+		if err != nil {
+			slog.Error("list public faves error", "error", err)
+		} else {
+			h.deps.Faves.LoadTags(faves)
+			totalPages := (total + defaultPageSize - 1) / defaultPageSize
+			data = map[string]any{
+				"Faves":      faves,
+				"Page":       page,
+				"TotalPages": totalPages,
+				"Total":      total,
+			}
+		}
+	}
+
+	h.deps.Renderer.Page(w, r, "home", render.PageData{Data: data})
 }
 
 func (h *Handler) handleHealth(w http.ResponseWriter, r *http.Request) {