feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/auth_integration_test.go

@@ -19,6 +19,7 @@ import (
 	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
 	"bountyboard/internal/domain"
+	"bountyboard/internal/files"
 	"bountyboard/internal/metrics"
 	"bountyboard/internal/store"
 	"bountyboard/internal/testutil"
@@ -47,7 +48,8 @@ func newAuthStack(t *testing.T, extraEnv map[string]string) (*httptest.Server, *
 	if os.Getenv("TEST_LOG") == "1" {
 		logOut = os.Stderr
 	}
-	srv := New(cfg, slog.New(slog.NewTextHandler(logOut, nil)), metrics.NewRegistry(), st)
+	srv := New(cfg, slog.New(slog.NewTextHandler(logOut, nil)), metrics.NewRegistry(), st,
+		files.NewStore(db, cfg.MaxUploadMB))
 	ts := httptest.NewServer(srv.Handler())
 	t.Cleanup(ts.Close)
 	return ts, srv, st, cfg