feat: add edit/delete buttons to list views and inline privacy toggle

Fave cards in the list and profile views now show edit, delete, and
privacy toggle buttons directly — no need to open the detail page first.

- New POST /faves/{id}/privacy route with HTMX privacy toggle partial
- New UpdatePrivacy store method for single-column update
- fave_list.html: edit link, HTMX delete, privacy toggle on every card
- profile.html: edit/delete for owner's own cards
- privacy_toggle.html: new HTMX partial that swaps inline on toggle
- CSS: compact .fave-card-actions styles

The existing handleFaveDelete already returns empty 200 for HTMX
requests, so hx-target="closest article" hx-swap="outerHTML" removes
the card from DOM seamlessly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/store/fave.go

@@ -73,6 +73,17 @@ func (s *FaveStore) Update(id int64, description, url, imagePath, notes, privacy
 	return err
 }
 
+// UpdatePrivacy toggles a fave's privacy setting.
+func (s *FaveStore) UpdatePrivacy(id int64, privacy string) error {
+	_, err := s.db.Exec(
+		`UPDATE faves SET privacy = ?,
+			updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+		WHERE id = ?`,
+		privacy, id,
+	)
+	return err
+}
+
 // Delete removes a fave by its ID. The cascade will clean up fave_tags.
 func (s *FaveStore) Delete(id int64) error {
 	result, err := s.db.Exec("DELETE FROM faves WHERE id = ?", id)