feat: add profiles, public views, settings, and code quality fixes

Phase 3 — Profiles & Public Views:
- Public profile page (/u/{username}) with OG meta tags
- User settings page (display name, bio, visibility, default privacy)
- Avatar upload with image processing
- Password change from settings (verifies current password)
- Home page shows public fave feed for logged-in users
- Must-reset-password guard redirects to /reset-password
- Profile visibility: public (full) or limited (username only)

Code quality improvements from /simplify review:
- Fix signup request persistence bug (was silently discarding data)
- Fix health check to use configured listen address, not hardcoded :8080
- Add rate limiter cleanup goroutine (was leaking memory)
- Extract shared helpers: ClearSessionCookie, IsSecureRequest, scanTags,
  scanUserFrom (scanner interface), SignupRequestStore
- Replace hand-rolled joinPlaceholders with strings.Join
- Remove dead _method hidden field, redundant devMode field
- Simplify rate-limited route registration (remove double-mux)
- Log previously-swallowed errors (session delete, image delete)
- Stop leaking internal error messages to users in image upload

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handler/handler.go

@@ -103,5 +103,14 @@ func (h *Handler) Routes() *http.ServeMux {
 	mux.HandleFunc("GET /tags/search", h.handleTagSearch)
 	mux.HandleFunc("GET /tags/{name}", h.handleTagBrowse)
 
+	// Profiles.
+	mux.HandleFunc("GET /u/{username}", h.handlePublicProfile)
+
+	// User settings (authenticated).
+	mux.Handle("GET /settings", requireLogin(http.HandlerFunc(h.handleSettingsGet)))
+	mux.Handle("POST /settings", requireLogin(http.HandlerFunc(h.handleSettingsPost)))
+	mux.Handle("POST /settings/avatar", requireLogin(http.HandlerFunc(h.handleAvatarPost)))
+	mux.Handle("POST /settings/password", requireLogin(http.HandlerFunc(h.handleSettingsPasswordPost)))
+
 	return mux
 }