Phase 1.2: session login + empty HTMX dashboard

- Session login for the single user Sam: server-side session store with an
  HMAC-signed session cookie, POST /login, POST /logout, and double-submit
  CSRF on every form post. Unauthenticated requests to / and /partials/*
  redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
  (category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
  design system into web/static; vendor htmx 2.0.4. No cross-project imports
  at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
  layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
  EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

README.md

@@ -9,19 +9,22 @@ pre-planning material and is not authoritative.
 
 ## Status
 
-**Phase 1.1 — Go service skeleton.** Complete when this file was written:
-config from the environment, SQLite schema init, `GET /health`, Dockerfile and
-docker-compose. Mail fetch, classification, login, and the HTMX screens come in
-later phases.
+**Phase 1.2 — Session login + empty dashboard.** The Go skeleton (Phase 1.1)
+plus a single-user session login, a copied Family Home Lab `tokens.css`, and an
+HTMX dashboard shell (left nav, centre list, right detail pane) with dark mode.
+Mail fetch, classification, and the rest come in later phases.
 
 ## Layout
 
 ```
 cmd/email-agent/        service entry point
 internal/config/        environment-driven configuration
+internal/session/       server-side session store + signed cookie values
 internal/store/         SQLite open + schema (internal/store/schema.sql)
-internal/server/        HTTP routes and middleware
+internal/server/        HTTP routes, auth middleware, HTMX handlers
 internal/version/       build metadata (set via -ldflags)
+web/static/             embedded design tokens, Inter fonts, htmx, app.css
+web/templates/          embedded server-rendered HTML
 Dockerfile              multi-stage, CGO-free build
 docker-compose.yml      this project's own container and image
 ```
@@ -42,7 +45,8 @@ Key variables:
 | `EMAIL_AGENT_PORT` | `8790` | Listen port (used when `EMAIL_AGENT_ADDR` is unset) |
 | `EMAIL_AGENT_DB_PATH` | `data/email_agent.db` | SQLite file |
 | `EMAIL_AGENT_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` |
-| `EMAIL_AGENT_SESSION_SECRET` | _(empty)_ | Session cookie signing key (Phase 1.2) |
+| `EMAIL_AGENT_SESSION_SECRET` | _(empty)_ | Session cookie signing key. If unset, an ephemeral key is used (sessions reset on restart) |
+| `EMAIL_AGENT_PASSWORD` | _(empty)_ | Login password for Sam. If unset, `EMAIL_AGENT_SESSION_SECRET` doubles as the password |
 
 ## Run locally
 
@@ -65,11 +69,20 @@ Caddy on `.35` proxies `mail.lab.audasmedia.com.au` to this port.
 
 ## Endpoints (Phase 1)
 
-| Method | Path | Purpose |
-|---|---|---|
-| `GET` | `/health` | Liveness + database check, JSON |
-| `GET` | `/readyz` | Readiness, JSON |
-| `GET` | `/` | Placeholder dashboard (real screens in Phase 1.2) |
+| Method | Path | Auth | Purpose |
+|---|---|---|---|
+| `GET` | `/health` | public | Liveness + database check, JSON |
+| `GET` | `/readyz` | public | Readiness, JSON |
+| `GET` | `/login` | public | Sign-in form (deep-indigo band) |
+| `POST` | `/login` | public | CSRF-checked password sign-in, sets the session cookie |
+| `POST` | `/logout` | session | Destroys the session, returns to `/login` |
+| `GET` | `/` | session | Empty dashboard shell |
+| `GET` | `/partials/inbox` | session | HTMX fragment for the centre list |
+| `GET` | `/static/…` | public | Embedded `tokens.css`, `app.css`, Inter fonts, `htmx.min.js` |
+
+Unauthenticated requests to `/` and `/partials/…` redirect to `/login?next=…`.
+Form posts use a double-submit CSRF token (`email_agent_csrf` cookie plus a
+hidden `csrf` field).
 
 ## Database