feat: implement Phase 1 (auth) and Phase 2 (faves CRUD) foundation

Go backend with server-rendered HTML/HTMX frontend, SQLite database,
and filesystem image storage. Self-hostable single-binary architecture.

Phase 1 — Authentication & project foundation:
- Argon2id password hashing with timing-attack prevention
- Session management with cookie-based auth and periodic cleanup
- Login, signup (open/requests/closed modes), logout, forced password reset
- CSRF double-submit cookie pattern with HTMX auto-inclusion
- Proxy-aware real IP extraction (WireGuard/Tailscale support)
- Configurable base path for subdomain and subpath deployment
- Rate limiting on auth endpoints with background cleanup
- Security headers (CSP, X-Frame-Options, Referrer-Policy)
- Structured logging with slog, graceful shutdown
- Pico CSS + HTMX vendored and embedded via go:embed

Phase 2 — Faves CRUD with tags and images:
- Full CRUD for favorites with ownership checks
- Image upload with EXIF stripping, resize to 1920px, UUID filenames
- Tag system with HTMX autocomplete (prefix search, popularity-sorted)
- Privacy controls (public/private per fave, user-configurable default)
- Tag browsing, pagination, batch tag loading (avoids N+1)
- OpenGraph meta tags on public fave detail pages

Includes code quality pass: extracted shared helpers, fixed signup
request persistence bug, plugged rate limiter memory leak, removed
dead code, and logged previously-swallowed errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pages/fave_detail.html

@@ -0,0 +1,73 @@
+{{define "head"}}
+{{with .Data}}{{with .Fave}}
+    {{if eq .Privacy "public"}}
+        <meta property="og:title" content="{{truncate 70 .Description}}">
+        <meta property="og:description" content="En favoritt av {{.DisplayName}} på {{$.SiteName}}">
+        <meta property="og:type" content="article">
+        {{if $.ExternalURL}}
+            <meta property="og:url" content="{{$.ExternalURL}}/faves/{{.ID}}">
+            {{if .ImagePath}}
+                <meta property="og:image" content="{{$.ExternalURL}}/uploads/{{.ImagePath}}">
+                <meta name="twitter:card" content="summary_large_image">
+            {{else}}
+                <meta name="twitter:card" content="summary">
+            {{end}}
+        {{end}}
+        <meta property="og:site_name" content="{{$.SiteName}}">
+        {{range .Tags}}
+            <meta property="article:tag" content="{{.Name}}">
+        {{end}}
+    {{end}}
+{{end}}{{end}}
+{{end}}
+
+{{define "content"}}
+{{with .Data}}
+    <article>
+        {{with .Fave}}
+            {{if .ImagePath}}
+                <img src="{{basePath}}/uploads/{{.ImagePath}}"
+                     alt="Bilde for: {{.Description}}">
+            {{end}}
+
+            <header>
+                <h1>{{.Description}}</h1>
+                <p>
+                    Av <a href="{{basePath}}/u/{{.Username}}">{{.DisplayName}}</a>
+                    {{if eq .Privacy "private"}}
+                        — <small class="badge-private" aria-label="Privat">Privat</small>
+                    {{end}}
+                </p>
+            </header>
+
+            {{if .URL}}
+                <p><a href="{{.URL}}" target="_blank" rel="noopener noreferrer">{{.URL}}</a></p>
+            {{end}}
+
+            {{if .Tags}}
+                <p>
+                    {{range .Tags}}
+                        <a href="{{basePath}}/tags/{{.Name}}" class="tag-chip">{{.Name}}</a>
+                    {{end}}
+                </p>
+            {{end}}
+
+            <footer>
+                <small>Lagt til {{.CreatedAt.Format "02.01.2006"}}</small>
+                {{if $.IsOwner}}
+                    <nav class="fave-actions">
+                        <a href="{{basePath}}/faves/{{.ID}}/edit" role="button" class="outline">Rediger</a>
+                        <button
+                            hx-delete="{{basePath}}/faves/{{.ID}}"
+                            hx-confirm="Er du sikker på at du vil slette denne favoritten?"
+                            hx-headers='{"X-CSRF-Token": "{{$.CSRFToken}}"}'
+                            class="outline secondary"
+                            data-redirect="{{basePath}}/faves"
+                        >Slett</button>
+                    </nav>
+                {{end}}
+            </footer>
+        {{end}}
+    </article>
+{{end}}
+{{end}}