feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/templates/home.html

@@ -0,0 +1,41 @@
+{{define "content"}}
+<h1>Welcome, {{.User.Name}}</h1>
+<div class="grid">
+  {{if .User.Roles.Developer}}
+  <div class="card">
+    <h2>Bounty Board</h2>
+    <p class="muted">Browse published tasks and request assignments.</p>
+    <a class="btn primary" href="/board">Open board</a>
+  </div>
+  <div class="card">
+    <h2>My Tasks</h2>
+    <p class="muted">Track your assigned and in-progress work.</p>
+    <a class="btn" href="/my-tasks">Open my tasks</a>
+  </div>
+  {{end}}
+  {{if .User.Roles.Consultant}}
+  <div class="card">
+    <h2>Atomization Board</h2>
+    <p class="muted">Subdivide imported tickets and publish bounties.</p>
+    <a class="btn primary" href="/consultant/board">Open atomization</a>
+  </div>
+  <div class="card">
+    <h2>Review Queue</h2>
+    <p class="muted">Approve or request changes on submitted work.</p>
+    <a class="btn" href="/consultant/reviews">Open reviews</a>
+  </div>
+  {{end}}
+  {{if .User.Roles.Admin}}
+  <div class="card">
+    <h2>Administration</h2>
+    <p class="muted">Customers, users, settings, audit log, service status.</p>
+    <a class="btn primary" href="/admin">Open admin</a>
+  </div>
+  {{end}}
+  <div class="card">
+    <h2>Messages</h2>
+    <p class="muted">Direct, group and project conversations.</p>
+    <a class="btn" href="/messages">Open messages</a>
+  </div>
+</div>
+{{end}}