Phase 1.2: session login + empty HTMX dashboard

- Session login for the single user Sam: server-side session store with an
  HMAC-signed session cookie, POST /login, POST /logout, and double-submit
  CSRF on every form post. Unauthenticated requests to / and /partials/*
  redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
  (category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
  design system into web/static; vendor htmx 2.0.4. No cross-project imports
  at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
  layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
  EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/config/config.go

@@ -42,6 +42,10 @@ type Config struct {
 	// service has a single configuration surface.
 	SessionSecret string
 
+	// Password is the single-user login password. When it is empty the service
+	// falls back to SessionSecret so one configured secret is enough. Secret.
+	Password string
+
 	// LogLevel controls slog verbosity: debug, info, warn, error.
 	LogLevel string
 
@@ -75,6 +79,7 @@ func Load() (*Config, error) {
 	c := &Config{
 		Env:                  getenvDefault("EMAIL_AGENT_ENV", DefaultEnv),
 		SessionSecret:        os.Getenv("EMAIL_AGENT_SESSION_SECRET"),
+		Password:             os.Getenv("EMAIL_AGENT_PASSWORD"),
 		LogLevel:             strings.ToLower(getenvDefault("EMAIL_AGENT_LOG_LEVEL", "info")),
 		PublicBaseURL:        strings.TrimRight(getenvDefault("EMAIL_AGENT_PUBLIC_BASE_URL", "http://localhost:8790"), "/"),
 		JEVBaseURL:           strings.TrimRight(os.Getenv("JEV_BASE_URL"), "/"),