feat: implement Phase 1 (auth) and Phase 2 (faves CRUD) foundation

Go backend with server-rendered HTML/HTMX frontend, SQLite database,
and filesystem image storage. Self-hostable single-binary architecture.

Phase 1 — Authentication & project foundation:
- Argon2id password hashing with timing-attack prevention
- Session management with cookie-based auth and periodic cleanup
- Login, signup (open/requests/closed modes), logout, forced password reset
- CSRF double-submit cookie pattern with HTMX auto-inclusion
- Proxy-aware real IP extraction (WireGuard/Tailscale support)
- Configurable base path for subdomain and subpath deployment
- Rate limiting on auth endpoints with background cleanup
- Security headers (CSP, X-Frame-Options, Referrer-Policy)
- Structured logging with slog, graceful shutdown
- Pico CSS + HTMX vendored and embedded via go:embed

Phase 2 — Faves CRUD with tags and images:
- Full CRUD for favorites with ownership checks
- Image upload with EXIF stripping, resize to 1920px, UUID filenames
- Tag system with HTMX autocomplete (prefix search, popularity-sorted)
- Privacy controls (public/private per fave, user-configurable default)
- Tag browsing, pagination, batch tag loading (avoids N+1)
- OpenGraph meta tags on public fave detail pages

Includes code quality pass: extracted shared helpers, fixed signup
request persistence bug, plugged rate limiter memory leak, removed
dead code, and logged previously-swallowed errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/pages/fave_list.html

@@ -0,0 +1,56 @@
+{{define "content"}}
+<header>
+    <hgroup>
+        <h1>Mine favoritter</h1>
+        <p>{{with .Data}}{{.Total}} favoritter totalt{{end}}</p>
+    </hgroup>
+    <a href="{{basePath}}/faves/new" role="button">+ Ny favoritt</a>
+</header>
+
+{{with .Data}}
+    {{if .Faves}}
+        <div class="fave-grid" role="list">
+            {{range .Faves}}
+                <article class="fave-card" role="listitem">
+                    {{if .ImagePath}}
+                        <img src="{{basePath}}/uploads/{{.ImagePath}}"
+                             alt="Bilde for: {{.Description}}"
+                             loading="lazy">
+                    {{end}}
+                    <header>
+                        <a href="{{basePath}}/faves/{{.ID}}">
+                            <strong>{{.Description}}</strong>
+                        </a>
+                        {{if eq .Privacy "private"}}
+                            <small class="badge-private" aria-label="Privat">Privat</small>
+                        {{end}}
+                    </header>
+                    {{if .Tags}}
+                        <footer>
+                            {{range .Tags}}
+                                <a href="{{basePath}}/tags/{{.Name}}" class="tag-chip">{{.Name}}</a>
+                            {{end}}
+                        </footer>
+                    {{end}}
+                </article>
+            {{end}}
+        </div>
+
+        {{if gt .TotalPages 1}}
+            <nav aria-label="Sidenavigasjon">
+                <ul>
+                    {{if gt .Page 1}}
+                        <li><a href="{{basePath}}/faves?page={{subtract .Page 1}}">← Forrige</a></li>
+                    {{end}}
+                    <li>Side {{.Page}} av {{.TotalPages}}</li>
+                    {{if lt .Page .TotalPages}}
+                        <li><a href="{{basePath}}/faves?page={{add .Page 1}}">Neste →</a></li>
+                    {{end}}
+                </ul>
+            </nav>
+        {{end}}
+    {{else}}
+        <p>Du har ingen favoritter ennå. <a href="{{basePath}}/faves/new">Legg til din første!</a></p>
+    {{end}}
+{{end}}
+{{end}}