feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)

- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
  system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
  contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/templates/register.html

@@ -0,0 +1,26 @@
+{{define "content"}}
+<div class="card">
+  <h1>Create account</h1>
+  <p class="hint">Self-registration creates a developer account. Consultant and admin roles are granted by an administrator.</p>
+  <div class="error-box" id="error" role="alert"></div>
+  <form id="register-form" class="mt">
+    <div class="field">
+      <label for="name">Name</label>
+      <input type="text" id="name" name="name" autocomplete="name" required>
+    </div>
+    <div class="field">
+      <label for="email">Email</label>
+      <input type="email" id="email" name="email" autocomplete="email" required>
+    </div>
+    <div class="field">
+      <label for="password">Password</label>
+      <input type="password" id="password" name="password" autocomplete="new-password" minlength="8" required>
+      <p class="hint">At least 8 characters.</p>
+    </div>
+    <div class="spread">
+      <button class="btn primary" type="submit">Create account</button>
+      <a href="/login">I already have an account</a>
+    </div>
+  </form>
+</div>
+{{end}}