Phase 1.2: session login + empty HTMX dashboard

- Session login for the single user Sam: server-side session store with an
  HMAC-signed session cookie, POST /login, POST /logout, and double-submit
  CSRF on every form post. Unauthenticated requests to / and /partials/*
  redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
  (category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
  design system into web/static; vendor htmx 2.0.4. No cross-project imports
  at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
  layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
  EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.env.example

@@ -15,8 +15,11 @@ EMAIL_AGENT_LOG_LEVEL=info
 EMAIL_AGENT_PUBLIC_BASE_URL=https://mail.lab.audasmedia.com.au
 
 # --- Session / auth --------------------------------------------------------
-# Generate with: openssl rand -hex 32
+# Session cookie signing key. Generate with: python3 -c 'import secrets;print(secrets.token_hex(32))'
 EMAIL_AGENT_SESSION_SECRET=change-me
+# Login password for the single user (Sam). If unset, the session secret above
+# doubles as the password.
+EMAIL_AGENT_PASSWORD=
 
 # --- Integrations (used from later phases) ---------------------------------
 JEV_BASE_URL=