feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/static/js/nav.js

@@ -0,0 +1,30 @@
+// Top navigation behaviors: logout + theme toggle (persisted to
+// localStorage immediately and to the profile when logged in).
+import { api, toast } from '/static/js/api.js';
+
+const logoutBtn = document.getElementById('nav-logout');
+if (logoutBtn) {
+  logoutBtn.addEventListener('click', async () => {
+    try {
+      await api('POST', '/api/v1/auth/logout', {});
+    } catch (e) { /* session may already be gone */ }
+    window.location.href = '/login';
+  });
+}
+
+const themeBtn = document.getElementById('nav-theme');
+if (themeBtn) {
+  themeBtn.addEventListener('click', async () => {
+    const el = document.documentElement;
+    const next = el.dataset.theme === 'dark' ? 'light' : 'dark';
+    el.dataset.theme = next;
+    try { localStorage.setItem('theme', next); } catch (e) { /* ignore */ }
+    if (document.body.dataset.loggedIn === '1') {
+      try {
+        await api('PATCH', '/api/v1/profile', { settings: { theme: next } });
+      } catch (e) {
+        toast('Could not save theme preference: ' + e.message, 'err');
+      }
+    }
+  });
+}