feat: add profiles, public views, settings, and code quality fixes

Phase 3 — Profiles & Public Views:
- Public profile page (/u/{username}) with OG meta tags
- User settings page (display name, bio, visibility, default privacy)
- Avatar upload with image processing
- Password change from settings (verifies current password)
- Home page shows public fave feed for logged-in users
- Must-reset-password guard redirects to /reset-password
- Profile visibility: public (full) or limited (username only)

Code quality improvements from /simplify review:
- Fix signup request persistence bug (was silently discarding data)
- Fix health check to use configured listen address, not hardcoded :8080
- Add rate limiter cleanup goroutine (was leaking memory)
- Extract shared helpers: ClearSessionCookie, IsSecureRequest, scanTags,
  scanUserFrom (scanner interface), SignupRequestStore
- Replace hand-rolled joinPlaceholders with strings.Join
- Remove dead _method hidden field, redundant devMode field
- Simplify rate-limited route registration (remove double-mux)
- Log previously-swallowed errors (session delete, image delete)
- Stop leaking internal error messages to users in image upload

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pages/home.html

@@ -1,10 +1,59 @@
 {{define "content"}}
-<hgroup>
-    <h1>Velkommen til {{.SiteName}}</h1>
-    <p>Del dine favoritter med verden — eller behold dem for deg selv.</p>
-</hgroup>
+{{if .User}}
+    <hgroup>
+        <h1>Siste offentlige favoritter</h1>
+        <p>Se hva folk deler</p>
+    </hgroup>
 
-{{if not .User}}
+    {{with .Data}}
+        {{if .Faves}}
+            <div class="fave-grid" role="list">
+                {{range .Faves}}
+                    <article class="fave-card" role="listitem">
+                        {{if .ImagePath}}
+                            <img src="{{basePath}}/uploads/{{.ImagePath}}"
+                                 alt="Bilde for: {{.Description}}"
+                                 loading="lazy">
+                        {{end}}
+                        <header>
+                            <a href="{{basePath}}/faves/{{.ID}}">
+                                <strong>{{.Description}}</strong>
+                            </a>
+                            <small>av <a href="{{basePath}}/u/{{.Username}}">{{.DisplayName}}</a></small>
+                        </header>
+                        {{if .Tags}}
+                            <footer>
+                                {{range .Tags}}
+                                    <a href="{{basePath}}/tags/{{.Name}}" class="tag-chip">{{.Name}}</a>
+                                {{end}}
+                            </footer>
+                        {{end}}
+                    </article>
+                {{end}}
+            </div>
+
+            {{if gt .TotalPages 1}}
+                <nav aria-label="Sidenavigasjon">
+                    <ul>
+                        {{if gt .Page 1}}
+                            <li><a href="{{basePath}}/?page={{subtract .Page 1}}">← Forrige</a></li>
+                        {{end}}
+                        <li>Side {{.Page}} av {{.TotalPages}}</li>
+                        {{if lt .Page .TotalPages}}
+                            <li><a href="{{basePath}}/?page={{add .Page 1}}">Neste →</a></li>
+                        {{end}}
+                    </ul>
+                </nav>
+            {{end}}
+        {{else}}
+            <p>Ingen offentlige favoritter ennå. <a href="{{basePath}}/faves/new">Legg til din første!</a></p>
+        {{end}}
+    {{end}}
+{{else}}
+    <hgroup>
+        <h1>Velkommen til {{.SiteName}}</h1>
+        <p>Del dine favoritter med verden — eller behold dem for deg selv.</p>
+    </hgroup>
     <div class="grid">
         <a href="{{basePath}}/login" role="button">Logg inn</a>
         <a href="{{basePath}}/signup" role="button" class="outline">Registrer deg</a>