feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/app/main.go

@@ -12,6 +12,7 @@ import (
 
 	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
+	"bountyboard/internal/files"
 	httpx "bountyboard/internal/http"
 	"bountyboard/internal/metrics"
 	"bountyboard/internal/store"
@@ -56,7 +57,7 @@ func run() error {
 	}
 
 	reg := metrics.NewRegistry()
-	srv := httpx.New(cfg, log, reg, st)
+	srv := httpx.New(cfg, log, reg, st, files.NewStore(st.DB, cfg.MaxUploadMB))
 	srv.AddReadinessCheck(httpx.ReadinessCheck{
 		Name:     "mongo",
 		Required: true,