feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/server.go

@@ -4,12 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"html/template"
 	"log/slog"
 	"net/http"
 	"time"
 
 	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
+	"bountyboard/internal/files"
 	"bountyboard/internal/metrics"
 	"bountyboard/internal/store"
 )
@@ -22,6 +24,8 @@ type Server struct {
 	log          *slog.Logger
 	metrics      *metrics.Registry
 	store        *store.Store
+	files        *files.Store
+	templates    map[string]*template.Template
 	oidc         *auth.OIDCClient
 	loginLimiter *auth.RateLimiter
 	checks       []ReadinessCheck
@@ -29,12 +33,20 @@ type Server struct {
 	httpSrv      *http.Server
 }
 
-func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.Store) *Server {
+func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.Store, fs *files.Store) *Server {
+	templates, err := parseTemplates()
+	if err != nil {
+		// Templates are embedded; failure is a build defect caught by any
+		// test or first boot, never a runtime condition.
+		panic(fmt.Sprintf("parse templates: %v", err))
+	}
 	s := &Server{
 		cfg:          cfg,
 		log:          log,
 		metrics:      reg,
 		store:        st,
+		files:        fs,
+		templates:    templates,
 		oidc:         auth.NewOIDCClient(cfg, log),
 		loginLimiter: auth.NewRateLimiter(10, 15*time.Minute),
 		startedAt:    time.Now(),
@@ -45,6 +57,8 @@ func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.
 	mux.HandleFunc("GET /readyz", s.handleReadyz)
 	mux.HandleFunc("GET /metricsz", s.handleMetricsz)
 	s.routesAuth(mux)
+	s.routesProfile(mux)
+	s.routesWeb(mux)
 
 	s.httpSrv = &http.Server{
 		Addr:              fmt.Sprintf(":%d", cfg.AppPort),